CSSLP practice examsIn development
Certified Secure Software Lifecycle Professional
Security across the software lifecycle: the governing principles and turning them into testable requirements, threat modelling and secure design, implementation practices that actually defeat the common flaws, security testing, lifecycle management, and deployment with a hardened supply chain.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Secure software concepts and secure software requirements | 24% |
| Secure software architecture, design and implementation | 28% |
| Secure software testing, lifecycle management, deployment and supply chain | 48% |
Two sample questions
1. Which check prevents an insecure direct object reference?
- Verifying the caller is authorised for the specific object — correct
- Replacing the identifier with a long random value
- Obscuring the identifier in the request body
- Rate limiting the requests from each caller
Why: The fix is a server-side authorisation check that the caller may access that specific object.
2. Which is a reason to remove default accounts and sample content before release?
- They are widely known and commonly targeted — correct
- They are undocumented and hard to audit
- They expire after the first production login
- They are required by the platform installer
Why: Default accounts and sample content are publicly documented and routinely targeted by attackers.
The real CSSLP exam
| Length | 180 minutes |
|---|---|
| Questions | 125 |
| Pass mark | 700 of 1000 |
| Price | $599 USD |
| Recommended before you sit it | Four years of cumulative paid work experience in the software development lifecycle in one or more of the eight domains, or three years with a relevant degree. |
| Valid for | 3 years, maintained with continuing professional education credits and an annual maintenance fee |
Exam facts as published by ISC2; always check the vendor’s page before you book.
Study CSSLP with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.