Free CSSD Practice Questions

Question 1

In a billing API, employees may read any invoice belonging to their own company, but never another company's. A signed-in employee replaces an invoice UUID in GET /invoices/{id} with a UUID learned from another company. The API returns that invoice. Session validation succeeds, and the query uses bound parameters. Which change closes the demonstrated gap?

Accepted Answer

Check that the invoice belongs to the tenant identified by the validated session.

Answer

Restrict the client-side invoice picker to records belonging to the employee's company.

Answer

Require multifactor authentication before employees can access the invoice endpoint.

Answer

Replace the invoice UUIDs with longer, cryptographically random record identifiers.

Question 2

An authenticated user visits an unrelated website. A hidden form there submits a profile-change request to the user's account on another service, and the browser automatically includes that service's session cookie. The change succeeds without the user's approval. Investigation finds no injected script on the account service and no copied cookie. Which attack best fits this evidence?

Accepted Answer

Cross-site request forgery using the browser's existing authenticated session.

Answer

Stored cross-site scripting executing within the account service's origin.

Answer

Session hijacking through reuse of a copied authentication cookie.

Answer

Clickjacking that conceals the service's genuine account-confirmation button.

Question 3

The test lead makes a specific request: "When our regression suite triggers this finding, I need the internal method and data flow responsible." Tests run against a deployed service, and the team can install an agent in that test runtime. Which technique supplies the requested execution evidence?

Accepted Answer

Interactive application security testing inside the running service.

Answer

Static application security testing of the service's source code.

Answer

Dynamic application security testing through the service's HTTP interface.

Answer

Software composition analysis of the deployed dependencies.

Question 4

A search endpoint binds its search term, but constructs its SQL statement as follows:

sql = "SELECT id, name FROM items WHERE name = ? ORDER BY " + request.sort

Only name and created_at are permitted sort columns, and both must remain available. The driver cannot bind column identifiers. Select the repair that preserves sorting without accepting SQL structure from the request.

Accepted Answer

Map each permitted sort choice to a fixed server-side column name.

Answer

Put the same dynamically assembled SQL inside a stored procedure.

Answer

Strip quotes and semicolons from request.sort before appending it.

Answer

Pass request.sort through the same SQL string-literal escaping routine used for text values.

Question 5

A vendor releases version 4.2 of a document-processing service. A new advisory affects a parser that may be included through a transitive dependency. Procurement holds a software bill of materials (SBOM) for version 4.1, while production runs a 4.2 container identified by its digest. Which record would most directly establish whether the affected parser version is included?

Accepted Answer

A build-generated SBOM tied to the deployed digest, including component versions and dependency relationships.

Answer

An independent penetration-test report for the deployed service's exposed endpoints.

Answer

A signature-verification record confirming that the vendor signed the container and its contents have not changed.

Answer

A license inventory of the current source manifest's direct dependencies.

Question 6

Monitoring confirms that one application server is receiving attacker commands over HTTPS and sending customer files to changing external destinations. The incident responder can isolate that server through endpoint controls without interrupting the other servers. Centralized logs are already preserved. What should the responder do first to contain the activity?

Accepted Answer

Isolate the affected server while keeping it powered on for evidence collection.

Answer

Power off every server in the application cluster to eliminate all possible communication paths.

Answer

Block the current destination address while leaving the server's other outbound connections available.

Answer

Capture a complete memory image before making any change to the server's network connectivity.

Question 7

"The AI wrote the handler and its tests; everything passes, so we can merge." The approved coding assistant produced a password-reset handler whose security requirement is that each token may succeed only once. Every generated test uses a fresh token, and static analysis is clean. Which independent review step would add the most relevant security evidence?

Accepted Answer

Independently test a second use of the same token and require rejection.

Answer

Replace the generated handler with handwritten code before permitting any further security testing.

Answer

Run the generated tests repeatedly using a larger sample of previously unused reset tokens.

Answer

Ask another approved AI assistant to review the generated code.

Question 8

An engineer must apply a reviewed schema migration to one production database during a 30-minute maintenance window. The change needs schema-alteration rights, not user administration or access to other databases. Which access arrangement fits the job without leaving unnecessary privileges behind?

Accepted Answer

Grant the engineer database-scoped schema-alteration privileges with automatic expiry after the approved window.

Answer

Use the shared deployment administrator account, then rotate its password when the migration finishes.

Answer

Postpone the approved migration until a full recertification of every production user's access is completed.

Answer

Grant a permanent database-administrator role protected by multifactor authentication and recorded sessions.

Question 9

A service encrypts records with AES-256-GCM using one key shared by several workers. Each worker derives its 96-bit nonce from a local counter that starts at zero whenever the worker starts. Encryption and decryption tests pass on each worker. What must change before concurrent operation is considered secure?

Accepted Answer

Ensure nonce uniqueness across all workers and restarts for each encryption key.

Answer

Move the key into a hardware security module; retain local counters.

Answer

Rotate the shared key daily while allowing workers to restart their counters within that day.

Answer

Use each record's stable identifier as its nonce, including whenever that record is updated.

Question 10

A customer asks a software supplier, "Show us that your access controls operated effectively from January through June." The supplier submits a SOC 2 Type 1 report as of June 30. The customer still lacks the requested period-specific evidence. Which document should the supplier provide?

Accepted Answer

A SOC 2 Type 2 report covering those controls throughout the January-June period.

Answer

An ISO/IEC 27001 certificate covering the supplier's information security management system.

Answer

The existing Type 1 report, because its assessment date is the final day of the requested period.

Answer

A penetration-test report on access controls examined on June 30.

Free CSSD Practice Questions

Domain 1: Understand the Fundamentals of Secure Software Development 15% of exam

Question 1

Question 2

Domain 2: Explain the Secure Software Development Lifecycle 22% of exam

Question 3

Question 4

Domain 3: Develop Secure Code 33% of exam

Question 5

Question 6

Question 7

Domain 4: Defending Against Cyberattacks 15% of exam

Question 8

Domain 5: Engage in Governance, Risk Management, and Compliance 15% of exam

Question 9

Question 10

That's 10 of 1,030