Be able to select the right control for a given flaw: output encoding for XSS, parameterized queries for SQL injection, authorization checks for IDOR, and generic error messages to prevent information disclosure. The single most important thing is matching the mitigation to the vulnerability class and its root cause.
Start practicing
Software Development Security — choose a session length
Free · No account required
Domain overview
Software Development Security covers how security is built into the software lifecycle rather than bolted on afterward. For CISSP, questions target secure coding practices, threat modeling, code review, and testing methods such as SAST, DAST, and penetration testing, plus how vulnerabilities like XSS, SQL injection, and broken access control are mitigated in web applications and APIs.
Exam objectives
Secure coding practices: input validation, output encoding, parameterized queries, and centralized error handling
Security testing types: SAST on source code, DAST on running apps, IAST, and penetration testing
Threat modeling methodologies such as STRIDE and how they map to design-level mitigations
Software development lifecycle models, DevSecOps, and change management controls for code integrity
Confusing SAST with DAST: SAST analyzes source or bytecode without executing it, while DAST tests a running application from the outside.
Treating input validation as sufficient for XSS; output encoding and context-aware escaping are the primary defenses.
Assuming authentication alone prevents access control flaws; missing authorization checks on object references cause IDOR.
Click any question to see the full explanation and answer options, or start a focused practice session above.
A security team is reviewing a web application that allows users to search for products. The application uses a SQL database and constructs queries by concatenating user input directly into the SQL statement. Which of the following is the most effective mitigation against SQL injection attacks?
2During a threat modeling session for a new online banking application, the team uses the STRIDE methodology. Which threat category addresses the risk of an attacker modifying transaction data in transit?
3A development team is fixing a stored cross-site scripting (XSS) vulnerability in a web application that displays user comments. The application stores comments in a database and renders them in HTML. Which of the following is the most secure approach to prevent XSS?
4A security architect is designing a system that must continue to function even when a component fails. The architect implements multiple layers of security controls so that if one fails, others still provide protection. Which principle is being applied?
5During a penetration test, a security analyst discovers that a web application allows an attacker to bypass authorization and view another user's private messages by simply changing a numeric ID in the URL. Which vulnerability is being exploited?
6A software development team is adopting secure coding practices. They decide to implement input validation for all user-supplied data. Which approach is recommended as the most effective for preventing injection attacks?
7A web application exposes an API that allows users to fetch data from internal network resources based on a URL parameter. An attacker discovers they can use this API to access internal servers that are not meant to be public. Which vulnerability is being exploited?
8A security analyst is reviewing the error handling of an application. The application currently displays detailed stack traces to users when an exception occurs. Which of the following is the best practice for error handling in production?
9A development team is implementing cryptographic functions for a new application. They need to store passwords securely. Which of the following is the most appropriate approach?
10A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?
11During a security audit of a web application, the following issues are found: (1) Session tokens are included in URLs, (2) The application does not invalidate session tokens after logout, and (3) Session tokens are predictable. Which THREE of the following controls are most appropriate to address these issues?
12A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?
13During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?
14A development team is implementing a web application that allows users to search for products. To prevent SQL injection attacks, which secure coding practice should be applied?
15A security architect is reviewing a design for an e-commerce application. The architect recommends implementing defense in depth. Which of the following is an example of this principle?
16Which type of security testing involves analyzing source code for vulnerabilities without executing the code?
17A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?
18During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?
19A developer is implementing cryptographic storage for sensitive user data. Which of the following is a cryptographic best practice?
20Which of the following is an example of an Insecure Direct Object Reference (IDOR) vulnerability?
21A security team is conducting a penetration test on a web application. They identify that the application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the most effective mitigation?
22During a vulnerability assessment, a security analyst discovers that a web application uses a library known to be vulnerable to Log4Shell (CVE-2021-44228). Which type of vulnerability does this represent?
23A development team is designing a new application and wants to ensure that if a failure occurs, the system remains secure by default. Which design principle should they apply?
24A security analyst is reviewing a web application that handles financial transactions. Which TWO of the following are effective controls against Cross-Site Request Forgery (CSRF)?
25A security engineer is hardening a web server before deploying a new application. Which TWO of the following are examples of security misconfiguration vulnerabilities that should be addressed?
26During the requirements gathering phase of a secure SDLC, the team uses a threat modeling approach that focuses on identifying threats such as spoofing, tampering, and denial of service. Which threat modeling methodology is being employed?
27A security architect is designing an authentication system. To prevent session fixation attacks, which secure design principle should be implemented?
28Which of the following is the primary purpose of output encoding in web application security?
29During a security assessment, a penetration tester discovers that a web application exposes internal IP addresses in error messages. Which vulnerability category does this represent?
30A development team is using a third-party library that is known to have a critical vulnerability. The team decides to continue using the library because it is widely used and the vulnerability has not been exploited. Which security risk is the team ignoring?
31Which of the following is a secure coding practice to prevent SQL injection attacks?
32A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?
33Which type of testing analyzes source code for security vulnerabilities without executing the program?
34A security engineer is evaluating a new third-party software component for use in a critical application. Which document is most important to review to understand the component's supply chain security?
35What is the primary purpose of a Web Application Firewall (WAF) in a deployment environment?
36A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?
37A security team is performing a risk assessment on a legacy application that uses insecure deserialization. Which TWO of the following are recommended approaches to mitigate the risk of insecure deserialization?
38An organization is planning to acquire a new SaaS application for customer relationship management. Which THREE of the following should be included in the vendor security assessment?
39During a code review, a developer identifies that the application uses a custom encryption algorithm for storing sensitive data. Which THREE of the following are secure cryptographic practices that should be recommended instead?
40A security analyst is reviewing the authentication mechanism of a web application. Which TWO of the following are examples of broken authentication vulnerabilities?
41A security architect is defining security requirements for a new software development project that will use an Agile methodology. The organization wants to ensure that security is integrated throughout the development lifecycle. Which TWO of the following practices BEST support this goal? (Choose two.)
42A software development team is preparing to release a new application. The security manager requires that the application be tested for security vulnerabilities before deployment. Which of the following testing approaches is specifically designed to simulate real-world attacks against a running application?
Be able to select the right control for a given flaw: output encoding for XSS, parameterized queries for SQL injection, authorization checks for IDOR, and generic error messages to prevent information disclosure. The single most important thing is matching the mitigation to the vulnerability class and its root cause.
The Courseiva CISSP question bank contains 42 questions in the Software Development Security domain, covering the 10% of the exam attributed to this domain in the official ISC2 blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Software Development Security domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included