(ISC)² CSSLP Practice Exam

What the (ISC)² CSSLP exam covers

• Secure Software Concepts84 questions
• Secure Software Lifecycle Management78 questions
• Secure Software Requirements90 questions
• Secure Software Architecture and Design105 questions
• Secure Software Implementation98 questions
• Secure Software Testing99 questions
• Secure Software Deployment, Operations, Maintenance77 questions
• Secure Software Supply Chain69 questions

Free (ISC)² CSSLP practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 700.

1. Question 1Secure Software Concepts

   A payments team argues that because all traffic is encrypted in transit with TLS 1.3, the application does not need to encrypt cardholder data at rest. Which secure design principle does this reasoning violate?

   • ADefense in depthCorrect
   • BEconomy of mechanism
   • COpen design
   • DSeparation of duties
   ✓ Correct answer: A

   Defense in depth requires layered, independent controls so that the failure of any one does not expose the asset. TLS protects data only while it moves between endpoints; it does nothing once the data is written to disk, replicated to a backup, or read by a compromised process on the host. A stolen disk image, a misconfigured backup bucket, or a SQL injection that reads the table all bypass transport encryption entirely. Encryption at rest is a separate layer addressing a separate threat, and the two are not substitutes. The argument treats one control as sufficient for risks it was never designed to address.

   Why the other options are wrong

   • BEconomy of mechanism argues for keeping designs small and simple so they can be verified. Adding encryption at rest makes the design slightly larger, so this principle would if anything be cited in defence of the team's position rather than against it.
   • COpen design holds that security must not depend on the secrecy of the design itself, only on the secrecy of keys. Nothing in this scenario depends on hiding how the system works.
   • DSeparation of duties splits a sensitive task so no single person can complete it alone. It is an authorisation and fraud control and has no bearing on which encryption layers are applied.
2. Question 2Secure Software Concepts

   A product ships with its administrative interface reachable from any network address and telemetry sharing switched on. Both can be changed after installation. Which principle does the shipped configuration violate?

   • ASecure defaultsCorrect
   • BOpen design
   • CComplete mediation
   • DLeast common mechanism
   ✓ Correct answer: A

   Secure defaults require that the configuration a product ships with be the safe one, because the majority of deployments never revisit it. Exposing an administrative interface to any address means every installation is reachable until somebody actively restricts it, and enabling telemetry by default makes data sharing an opt-out rather than an informed choice. The availability of a setting does not discharge the obligation, since the burden of the default falls on every operator who does not know to look. The safe direction is to ship restricted and let deliberate configuration open things up.

   Why the other options are wrong

   • BOpen design requires that security not rest on the design being secret. This product's design is not hidden, and publishing every detail of it would leave the exposed default exactly as risky.
   • CComplete mediation requires that each access be checked rather than inferred from an earlier decision. The administrative interface may well authenticate every request, and the objection is to who can reach it at all.
   • DLeast common mechanism cautions against resources shared across users becoming channels between them. Nothing described is shared between tenants or users, so the principle does not apply to this configuration.
3. Question 3Secure Software Lifecycle Management

   A defect tracker records all issues with a single severity scale and no security flag. What does the organisation lose?

   • AThe ability to report, trend and prioritise security defects as a distinct classCorrect
   • BThe ability to assign defects to a specific engineer for remediation work
   • CThe ability to link a defect to the release in which it was first observed
   • DThe ability to record how long a defect remained open before being closed
   ✓ Correct answer: A

   Security defects need to be distinguishable because they are governed differently: they carry their own remediation deadlines, they feed disclosure obligations, they are reported to different audiences, and their trend over time is one of the few meaningful measures of a programme. Where they are indistinguishable from functional defects, none of that is possible, and in practice they are prioritised against feature work by product managers with no visibility of the exposure. A flag plus a severity basis consistent with the organisation's risk scale is the minimum needed.

   Why the other options are wrong

   • BAssignment to an engineer is a standard field in any tracker and is unaffected by the absence of a security flag. Work can be routed without the class being identifiable.
   • CLinking a defect to the release where it was first observed is a versioning field that most trackers provide. It records provenance rather than classifying the defect type.
   • DTime open is derived from the created and closed timestamps, which the tracker holds regardless. Age can be computed for every defect without a security classification.
4. Question 4Secure Software Requirements

   A treasury application must ensure that no single employee can both create and release a high-value payment. Which requirement expresses this in the system?

   • ARelease shall require approval by a different authenticated user than the one who created the paymentCorrect
   • BRelease shall require the approving user to hold a role that includes the release permission
   • CRelease shall be recorded with the identity of both the creating and the approving user
   • DRelease shall require the creating user to re-authenticate before the payment is submitted
   ✓ Correct answer: A

   Maker-checker only works if the system refuses the case where both actions come from the same identity. Stating that requirement explicitly is necessary because implementations routinely check that the approver holds the permission without checking that they are a different person, which permits the exact scenario the control exists to prevent when one employee holds both roles. The requirement should also address delegation, since an approver who can delegate to themselves reintroduces the problem, and it should define what happens when only one authorised approver is available.

   Why the other options are wrong

   • BRequiring the approver to hold the release permission is necessary and insufficient. A user holding both the creation and release permissions satisfies it while performing both steps alone.
   • CRecording both identities produces an audit trail that would reveal the problem afterwards. It is a detective measure and does not prevent one person from occupying both positions.
   • DRe-authentication by the creating user confirms their presence at submission and defends against an unattended session. It does not introduce a second person into the process.
5. Question 5Secure Software Architecture and Design

   A design specifies TLS cipher suites and is asked to ensure that recorded traffic cannot be decrypted later if the server's private key is compromised. Which property is required?

   • AForward secrecy, using ephemeral key agreement for each sessionCorrect
   • BA longer server key, so that recovering it becomes computationally infeasible
   • CAuthenticated encryption, so recorded ciphertext cannot be modified undetected
   • DCertificate pinning, so an attacker cannot present a substitute certificate
   ✓ Correct answer: A

   Forward secrecy is provided by ephemeral key agreement, where each session establishes a fresh key through a Diffie-Hellman exchange and the resulting secret is discarded when the session ends. The server's long-term private key authenticates the exchange rather than encrypting the session key, so obtaining it later does not decrypt recorded traffic. Without this property, an adversary who records ciphertext today and obtains the private key at any point in the future can decrypt everything retrospectively, which is a meaningful threat for traffic worth storing.

   Why the other options are wrong

   • BA longer server key raises the cost of recovering it by computation and does nothing if the key is obtained through a compromise, a subpoena or an insider. The scenario stipulates that the key is compromised.
   • CAuthenticated encryption prevents undetected modification of the traffic. It protects integrity rather than preventing retrospective decryption once the key is known.
   • DPinning constrains which certificate a client will accept and defeats interception with a substitute certificate. It does not affect whether past sessions can be decrypted with the genuine private key.
6. Question 6Secure Software Implementation

   A login routine builds an LDAP filter by inserting the submitted username directly. A user submits a value containing a wildcard and a closing parenthesis. What is the likely outcome?

   • AThe filter's structure is altered so it matches entries the query was meant to excludeCorrect
   • BThe directory rejects the request because the filter syntax is no longer valid
   • CThe wildcard is treated as a literal character, so the lookup simply fails to match
   • DThe directory returns an error disclosing the full filter, which is the only impact
   ✓ Correct answer: A

   LDAP filters have their own syntax, and parentheses, asterisks, ampersands and pipes are structural. A submitted value carrying them can close the intended clause and append another, commonly turning a filter that requires a matching username and password into one that requires only a username, or one that matches every entry. The remedy is to escape values according to the directory's filter escaping rules, or better to use an API that binds values into the filter, and to keep authentication as a bind operation rather than an attribute comparison.

   Why the other options are wrong

   • BA carefully constructed payload produces a syntactically valid filter, which is what the attacker aims for. A malformed attempt would be rejected, and that is the failed case rather than the risk.
   • CWildcards are treated as syntax rather than as literals unless they have been escaped, which is precisely the omission described. Treating them literally is what escaping would achieve.
   • DError messages disclosing the filter are a secondary information leak that sometimes occurs. The primary impact is a filter whose logic the attacker controls.
7. Question 7Secure Software Implementation

   A password change form asks for the new password twice but not for the current one. Which attack does this omission enable?

   • AAn attacker with a hijacked session can take permanent control by changing the passwordCorrect
   • BAn attacker can enumerate valid accounts by observing which changes are accepted
   • CAn attacker can bypass the password strength policy by submitting the value twice
   • DAn attacker can recover the previous password from the change confirmation message
   ✓ Correct answer: A

   A hijacked session, obtained through a stolen cookie, a shared machine or an unattended browser, is a temporary foothold that ends when the session expires. Changing the password converts it into permanent control and simultaneously locks the legitimate owner out. Requiring the current password means the attacker needs knowledge they do not have, so the foothold stays temporary. The same reasoning applies to changing the recovery address or the registered second factor, and all three should also notify the previously verified channel.

   Why the other options are wrong

   • BAccount enumeration concerns whether the system reveals which identifiers exist, and this form is used by an already authenticated user. No enumeration signal is produced.
   • CStrength policy is enforced against the new value regardless of how many times it is submitted. Repeating the entry is a typing safeguard rather than a policy bypass.
   • DThe previous password is not recoverable, since it should be stored as a one-way hash and confirmation messages do not include it. Nothing in the flow discloses it.
8. Question 8Secure Software Testing

   An anti-automation control is being tested on a sign-in endpoint. Which observation indicates the control is weak?

   • AAutomated attempts continue to succeed when the source address is varied between requestsCorrect
   • BAutomated attempts are refused after a small number of requests from one address
   • CAutomated attempts are delayed progressively as the number of failures increases
   • DAutomated attempts trigger a challenge that a script cannot complete unaided
   ✓ Correct answer: A

   Attackers rotate source addresses as a matter of course, using proxy pools and compromised hosts, so a control keyed solely to the address stops only unsophisticated attempts. The test that reveals this is to vary the address while holding the target account or the credential pattern constant, and to vary the account while holding the address constant, since a control may key on one and not the other. A robust design combines several signals, including per-account failure counts, credential reuse across accounts, device characteristics and behavioural indicators.

   Why the other options are wrong

   • BRefusal after a few requests from one address is the control working on that dimension. It is evidence of enforcement rather than of weakness.
   • CProgressive delay is a sound design that slows automation without giving an attacker the ability to lock out a named account. Observing it indicates a considered control.
   • DA challenge a script cannot complete unaided is the control functioning as intended. Solving services reduce its strength over time, which is a reason for layered signals rather than evidence of weakness here.
9. Question 9Secure Software Deployment, Operations, Maintenance

   During response, an engineer restarts the affected service to clear the immediate problem. What has been lost?

   • AVolatile evidence and the intruder's active state, which cannot be recovered afterwardsCorrect
   • BThe service's configuration, which will need to be reapplied from the source of truth
   • CThe application logs written before the restart, which are cleared on service start
   • DThe network connections to downstream services, which must be re-established manually
   ✓ Correct answer: A

   Restarting clears process memory, terminates the intruder's session, and removes anything that existed only in the running process, including injected code that never wrote to disk and keys held in memory. None of it can be recovered afterwards, and its absence frequently prevents the investigation from establishing how the intrusion occurred or what was accessed. This is why response procedures specify capturing volatile state before any remedial action, and why the instinct to make the symptom stop has to be trained against.

   Why the other options are wrong

   • BConfiguration is reapplied automatically on start where it is managed declaratively, and is otherwise persisted. It is recoverable, which volatile memory is not.
   • CApplication logs are written to a file or shipped to a platform and survive a restart. Losing them would require deletion rather than a restart.
   • DConnections to downstream services are re-established automatically as the service starts. It is a transient operational effect rather than a loss.
10. Question 10Secure Software Supply Chain

    A project invests in making its builds reproducible, so the same source yields a bit-identical artefact. What supply chain benefit does that unlock?

    • AAn independent party can rebuild the source and confirm the published artefact matchesCorrect
    • BThe build becomes faster, since deterministic steps can be cached more aggressively
    • CThe artefact becomes smaller, since non-deterministic padding is eliminated
    • DThe build no longer needs to run in an isolated environment, since output is deterministic
    ✓ Correct answer: A

    Without reproducibility, a published binary has to be trusted on the strength of who built it, because nobody can check that it corresponds to the source. Reproducibility makes independent verification possible: a third party rebuilds from the claimed revision and compares, and a match establishes that the binary contains what the source says and nothing else. That is the only technique that detects a compromised build system inserting code, since such an insertion produces a binary that no independent rebuild reproduces.

    Why the other options are wrong

    • BDeterminism does improve cache effectiveness, which is a welcome efficiency gain. Speed is a side effect rather than the supply chain benefit.
    • CArtefact size is largely unchanged, since the work is to remove timestamps, paths and ordering variation rather than content. Size reduction is incidental at best.
    • DIsolation remains important, because a compromised environment can alter inputs and therefore change the output deterministically. Reproducibility helps detect that rather than removing the need for isolation.

Who this (ISC)² CSSLP practice exam is for

This practice set is for anyone preparing for the (ISC)² CSSLP exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this (ISC)² CSSLP practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real (ISC)² CSSLP exam.

Related Security resources

• (ISC)² CSSLP study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• (ISC)² SSCP (Systems Security Certified Practitioner) practice examRelated
• Splunk Core Certified Power User (SPLK-1002) practice examRelated
• CompTIA Cloud+ (CV0-004) practice examRelated

(ISC)² CSSLP practice exam FAQ