Certified Secure Software Lifecycle Professional (CSSLP)

Last checked October 22, 2026 against the official ISC2 exam page.

1. Question 1Secure Software Architecture and Design

   Which design principle limits the damage that a compromised component can cause to the rest of the system?

   1. AIsolation or compartmentalisation, which separates components so that a breach stays contained
   2. BMaximising shared state, which lets every component read and write the same global data at all times
   3. CHard-coding trust, which assumes that all internal components are always safe and need no checks at all
   4. DSingle point of entry, which routes all data through one unchecked module without any monitoring for activity
   Show answer and explanationHide answer

   Correct answer: A

   Isolation or compartmentalisation contains the damage from a compromised component. Shared global state, hard-coded trust and unchecked single entry points increase damage.

2. Question 2Secure Software Implementation

   Which practice most directly prevents SQL injection in application code?

   1. ARemoving all special characters from every input field and then concatenating the cleaned text into the query
   2. BUsing parameterised queries or prepared statements instead of building SQL by joining strings with user input
   3. CStoring the database password in the query text so that the query can be run without any connection setup
   4. DDisabling error messages in the database so that attackers cannot see the structure of the query being run
   Show answer and explanationHide answer

   Correct answer: B

   Parameterised queries keep user input separate from SQL, which directly prevents injection. Stripping characters is fragile, and the other options do not address the root cause.

3. Question 3Secure Software Concepts

   Which principle states that a system should grant each user only the access needed to perform their task?

   1. ASecurity through obscurity, which hides the design of a system so that attackers cannot easily find its flaws
   2. BDefense in depth, which layers several controls so that one failure does not expose the whole system
   3. CSeparation of duties, which divides a critical task among several people to reduce the chance of fraud
   4. DLeast privilege, which limits each account to the minimum rights required for its role
   Show answer and explanationHide answer

   Correct answer: D

   Least privilege limits each account to the minimum rights its role requires. Defense in depth, separation of duties and security through obscurity are other principles with different aims.

4. Question 4Secure Software Testing

   Which testing approach examines the internal structure and code of an application?

   1. AWhite-box testing, which uses knowledge of the source code and design to test the internal logic
   2. BBlack-box testing, which uses only the external behaviour of the application with no knowledge of its internals
   3. CPenetration testing against live production systems with no prior notice to the operations team at any time
   4. DUser acceptance testing, which checks whether the business users are satisfied with the features in the release
   Show answer and explanationHide answer

   Correct answer: A

   White-box testing uses internal knowledge. Black-box testing uses external behaviour only, and penetration and acceptance testing have different focuses.

5. Question 5Secure Software Requirements

   Which type of requirement describes what the software must do to stay secure?

   1. AA performance target, such as a page load time below two seconds for a standard request by a user
   2. BA security functional requirement, such as requiring authentication before access to a sensitive function
   3. CA usability goal, such as making the interface easy to learn by a first-time user without any training
   4. DA cost estimate, such as the budget allocated to the development team for the whole of the next year
   Show answer and explanationHide answer

   Correct answer: B

   Security functional requirements state required secure behaviour. Performance, usability and cost statements are not security requirements.