Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which activity is most closely associated with the requirements phase of the software development lifecycle?
1.1 Understand the software development lifecycle and where security activities fit.
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
An intentionally vulnerable application for practicing web security in a controlled lab. Useful supplementary work for application-security topics.
Try it: Run a local, isolated instance using the project's instructions. Complete one introductory challenge, explain its root cause, and write the server-side control that would prevent it.
Open-source application; can run locally. Keep the intentionally vulnerable app isolated from public networks.
OWASP's testing methodology adds structure to application-security review. It supplements exam objectives rather than replacing a certification owner's guide.
Try it: Choose one testing category relevant to a missed question. In your own lab, record the test precondition, expected secure behavior, evidence, and remediation.
Free to read. Perform exercises only in your own lab or an explicitly authorized environment.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Which activity is most closely associated with the requirements phase of the software development lifecycle?
Defining security controls
Performing static code analysis
Conducting user acceptance testing
Applying security patches
Correct answer
Defining security controls
Defining security controls during requirements ensures security is considered early. Static analysis and patching occur later, and user acceptance testing validates completed functionality.
What is the primary goal of threat modeling in application security?
To identify and prioritize potential threats
To document user access permissions
To verify code syntax correctness
To measure system performance under load
Correct answer
To identify and prioritize potential threats
Threat modeling helps identify and rank potential threats to an application so that mitigation can be planned effectively. The other options describe different security or engineering tasks.
Which principle ensures that a user or process has only the necessary access to perform their tasks?
Least privilege
Separation of duties
Need-to-know
Fail securely
Correct answer
Least privilege
The least privilege principle limits access rights to the minimum necessary for a user or process. Separation of duties and need-to-know address different aspects of security control.
What does a security policy primarily define?
High-level rules and expectations for security behavior
Detailed technical configurations for firewalls
Step-by-step incident response procedures
Encryption algorithms to be used in code
Correct answer
High-level rules and expectations for security behavior
A security policy establishes high-level rules and expectations to guide organizational security practices. Technical configurations and procedures are derived from or support the policy.
Which practice helps prevent common coding vulnerabilities such as injection flaws?
Input validation and parameterized queries
Increasing server memory
Using complex passwords only
Disabling logging features
Correct answer
Increasing server memory
Validating input and using parameterized queries are key defenses against injection attacks. The other options do not directly mitigate common coding vulnerabilities.
What is the main purpose of security testing in the development lifecycle?
To verify that security requirements are met
To train developers on new programming languages
To reduce the cost of hardware infrastructure
To finalize user documentation
Correct answer
To verify that security requirements are met
Security testing checks whether implemented features meet defined security requirements and controls. It does not relate to training, hardware costs, or documentation finalization.
Which of the following is an example of an operational security control?
Security awareness training for staff
Encryption of data at rest
Intrusion detection system configuration
Secure coding standards
Correct answer
Security awareness training for staff
Operational controls involve procedures and practices, such as training, to protect operations. Encryption and secure coding are technical controls, while IDS configuration is a technical preventive control.
Why is it important to classify information assets in an organization?
To determine appropriate protection levels
To eliminate the need for access controls
To simplify software development
To reduce the number of users in the system
Correct answer
To determine appropriate protection levels
Classifying assets helps ensure that protection efforts align with the value and sensitivity of the information. It does not remove the need for controls or directly simplify development.
Which activity is most relevant during the implementation phase from a security perspective?
Designing security architecture
Applying secure coding practices
Conducting risk assessment
Reviewing business requirements
Correct answer
Applying secure coding practices
The implementation phase focuses on building the system, making secure coding practices critical. Architecture design and risk assessment are typically earlier activities.
What does the principle of fail securely aim to achieve?
Ensure the system remains in a safe state when failures occur
Maximize system performance under failure conditions
Minimize the number of security features
Allow unrestricted access during maintenance
Correct answer
Ensure the system remains in a safe state when failures occur
Failing securely ensures that when a component fails, the system defaults to a safe and restricted state. This prevents insecure or undefined behavior during faults.
Which of the following is a key objective of security architecture design?
Defining how security controls are integrated into the system
Writing user manuals for end users
Selecting office locations for data centers
Determining marketing strategies for the product
Correct answer
Defining how security controls are integrated into the system
Security architecture design focuses on how security mechanisms and controls are structured and integrated. The other options are unrelated to technical architecture.
Which practice supports secure software maintenance and updates?
Patch management processes
Removing all logging capabilities
Using default configurations
Skipping regression testing
Correct answer
Patch management processes
Patch management ensures that updates and fixes are applied in a controlled and tested manner. The other options would reduce security or stability.
What role does risk assessment play in application security?
To identify and prioritize risks for mitigation
To replace the need for security testing
To guarantee zero vulnerabilities
To enforce user interface design standards
Correct answer
To identify and prioritize risks for mitigation
Risk assessment helps identify and rank risks so that appropriate mitigation strategies can be applied. It does not replace testing or guarantee absolute security.
Which activity is most relevant to the operation and maintenance phase of security management?
Monitoring and responding to security incidents
Defining initial project scope
Drafting the initial security policy
Selecting development tools
Correct answer
Monitoring and responding to security incidents
Operation and maintenance involve ongoing monitoring, incident response, and ensuring controls remain effective. The other activities belong to earlier project phases.
What is the primary purpose of conducting a security audit in software development?
To verify compliance with security policies and standards
To replace the need for threat modeling
To eliminate all security vulnerabilities
To reduce the cost of development
Correct answer
To verify compliance with security policies and standards
Security audits are conducted to assess adherence to established security policies and standards, ensuring that security controls are implemented as intended.
Recall the answer before opening each card.
Requirements phase. Security controls must be defined early to ensure security is built in from the start (Q1).
To identify and prioritize potential threats. This informs mitigation planning (Q2).
Least privilege. It ensures users and processes have only the access needed to perform tasks (Q3).
High-level rules and expectations for security behavior. Policies guide organizational security practices (Q4).
Input validation and parameterized queries. These prevent attackers from injecting malicious code (Q5 explanation).
To verify that security requirements are met. It checks implemented features against security controls (Q6).
Security awareness training for staff. Operational controls involve procedures and practices (Q7).
To determine appropriate protection levels. Classification ensures protection matches asset sensitivity (Q8).
Applying secure coding practices. The implementation phase focuses on building the system securely (Q9).
Ensure the system remains in a safe state when failures occur. This prevents insecure default behavior (Q10).
Defining how security controls are integrated into the system. It structures security mechanisms (Q11).
Patch management processes. It ensures updates are applied in a controlled, tested manner (Q12).
To identify and prioritize risks for mitigation. It informs where to focus security efforts (Q13).
Monitoring and responding to security incidents. This ensures ongoing effectiveness of controls (Q14).
To verify compliance with security policies and standards. Audits assess adherence to established rules (Q15).
Systems should default to a safe state when a failure occurs, preventing insecure behavior (Q10).
Threat modeling identifies and prioritizes threats; risk assessment identifies and prioritizes risks (threats plus likelihood/impact). Both inform mitigation (Q2, Q13).
Encryption. Technical controls are implemented through technology (hardware, software, firmware) (Q7 context).
Defining security controls and requirements that the system must meet. This is the earliest opportunity to embed security (Q1).
To apply security fixes in a controlled, tested manner to reduce vulnerabilities without breaking functionality (Q12).
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
The practice bank emphasizes placing security activities in the correct SDLC phase. For example, defining security controls is a requirements-phase activity (Q1), while applying secure coding practices belongs to implementation (Q9). Security testing verifies that requirements are met (Q6), and monitoring/incident response occurs during operations and maintenance (Q14). Understanding this flow is critical for the CSSLP, as it ensures security is integrated early and continuously. Mistakes often arise from confusing when a task occurs—for instance, static analysis is a verification activity, not requirements. Use the phase to guide your choice.
Key principles tested include least privilege (Q3) and fail securely (Q10). Least privilege restricts access to the minimum necessary for tasks. Fail securely ensures the system defaults to a safe state upon failure. The practice bank also differentiates control types: operational controls like security awareness training (Q7) versus technical controls like encryption. Asset classification (Q8) determines protection levels but does not eliminate the need for other controls. Security policies (Q4) set high-level rules, which are then implemented via standards and procedures. These concepts are foundational to the CSSLP’s security architecture domain.
Threat modeling (Q2) and risk assessment (Q13) are proactive analysis techniques. Threat modeling identifies and prioritizes potential threats so mitigations can be planned; it uses models like STRIDE or attack trees. Risk assessment identifies and ranks risks (from threats and vulnerabilities) to guide mitigation decisions. Both outputs feed into security requirements and design. The practice bank stresses that these activities do not guarantee absolute security nor replace testing—they inform where to focus efforts. For the CSSLP, know the difference: threat modeling is about threats, risk assessment is about overall risk (including likelihood and impact).
The practice bank covers security in implementation (Q9: secure coding) and maintenance (Q12: patch management, Q14: monitoring/incident response). Secure coding practices like input validation and parameterized queries prevent injection flaws (Q5). Patch management ensures updates are tested and deployed securely. Security audits (Q15) verify compliance with policies and standards. During operations, monitoring detects anomalies and triggers incident response. These activities protect the application after deployment. The CSSLP expects you to know that security is a lifecycle concern—maintenance is not an afterthought but a critical phase for ongoing risk management.
Study workflow
For each security activity (e.g., defining controls, penetration testing, patching), recall which SDLC phase it belongs to. Use the practice bank as a reference: requirements = defining controls, design = threat modeling, implementation = secure coding, testing = security testing, operations = monitoring/patching. Create a mental timeline.
When you encounter a security control, classify it as administrative (policy, training), technical (encryption, firewall), or physical (locks, guards). The practice bank highlights operational controls (a subset of administrative) such as awareness training. Practice by listing three examples of each type.
For scenarios involving access, ask: Is least privilege applied? If a system fails, does it fail securely? Does it enforce separation of duties? The practice bank tests least privilege and fail securely. Review definitions and think of counterexamples that violate these principles.
Take a simple web application and list assets, threats (e.g., injection, XSS), and controls. Prioritize threats by impact and likelihood. The practice bank emphasizes threat modeling's goal: identification and prioritization. Write down each step to internalize the process.
Based on the practice bank's audit purpose (verify compliance), draft a checklist that includes policy adherence, control effectiveness, and evidence collection. Contrast this with a penetration test (which finds vulnerabilities). Use Q15 and your own knowledge to differentiate audit from assessment.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
A security policy defines high-level rules and expectations (e.g., 'All data must be encrypted at rest'). A standard provides specific, mandatory requirements to implement the policy (e.g., 'Use AES-256 encryption'). The practice bank's Q4 defines policy as high-level rules, from which standards and procedures are derived.
Input validation ensures that user-supplied data conforms to expected formats, rejecting dangerous characters. Parameterized queries separate SQL logic from data, preventing attackers from injecting commands. These techniques were identified in the explanation for Q5 as key defenses against injection.
STRIDE is a mnemonic for threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. It helps systematically identify threats during threat modeling. The practice bank's Q2 focuses on the goal of threat modeling (identify and prioritize threats), and STRIDE is a common tool.
Security testing belongs to the verification/validation phase after implementation, but it can occur iteratively. Its primary purpose, as stated in Q6, is to verify that security requirements are met. This is distinct from user acceptance testing (UAT), which validates functionality, not security.
Patch management should be a continuous process. Critical patches should be tested and deployed as soon as possible, typically within days or weeks depending on risk. The practice bank's Q12 highlights patch management as a key practice for secure maintenance, emphasizing controlled application to avoid instability.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
