CISSP Software Development Security — 20 Questions

Question 1

A security team is reviewing a newly acquired third-party software component. They want to ensure that the component's supply chain is secure and that known vulnerabilities are identified. Which of the following tools provides a list of all open-source and third-party components used in the software?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) is a formal, structured record (an inventory) containing the details and supply chain relationships of components used in building software. Software Composition Analysis (SCA) is the tool category used to analyze the software and generate this list.

Answer

Vulnerability scanner

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Question 2

A developer is implementing authentication for a new application. To protect against brute-force attacks, the developer decides to implement account lockout after a certain number of failed attempts. Which security principle does this control enforce?

Accepted Answer

Fail-secure. Account lockout is an implementation of the 'fail-secure' (or fail-closed) principle. When a threshold of failed login attempts is reached (representing a failure of the authentication process or a potential attack), the system transitions to a secure state by blocking further access attempts to that account until it is explicitly unlocked by an administrator or a cooldown period expires.

Answer

Strong authentication

Answer

Defense in depth

Answer

Least privilege

Question 3

A security engineer is hardening a web server before deploying a new application. Which TWO of the following are examples of security misconfiguration vulnerabilities that should be addressed?

Accepted Answer

Default administrator credentials remain unchanged. Default administrator credentials are a classic security misconfiguration because they represent a failure to change vendor-supplied defaults before deployment. Attackers can easily guess or look up these credentials to gain unauthorized access to the web server's management interface.

Verbose error messages revealing stack traces to users is also a security misconfiguration. Proper error handling should be configured to display generic error messages to users while logging detailed stack traces securely on the server side. Revealing stack traces can expose underlying technologies, database structures, and code paths, aiding attackers in crafting targeted exploits. Both of these are explicitly listed under OWASP Top 10 A05:2021 - Security Misconfiguration.

Answer

Use of an outdated version of a JavaScript library with known vulnerabilities

Answer

Lack of CSRF tokens in forms

Answer

Weak password policy allowing short passwords

Question 4

A security team is performing a risk assessment on a legacy application that uses insecure deserialization. Which TWO of the following are recommended approaches to mitigate the risk of insecure deserialization?

Accepted Answer

Implementing integrity checks (e.g., digital signatures) on serialized objects. Implementing integrity checks, such as digital signatures, ensures that serialized objects have not been tampered with during transit or storage. This prevents an attacker from modifying the serialized data to inject malicious payloads. Additionally, using allow lists (or look-ahead deserialization) restricts the classes that can be deserialized to only those that are expected and safe, preventing the instantiation of arbitrary or malicious classes (gadget chains) even if the attacker can manipulate the input stream.

Answer

Encrypting the serialized data

Answer

Using generic exception handling to catch errors

Answer

Logging all deserialization attempts

Question 5

During a code review, a developer identifies that the application uses a custom encryption algorithm for storing sensitive data. Which THREE of the following are secure cryptographic practices that should be recommended instead?

Accepted Answer

Using industry-standard algorithms (e.g., AES-256). Using industry-standard, peer-reviewed algorithms like AES-256 (Option A) ensures that the cryptographic strength is mathematically sound and free of the common design flaws found in custom 'security through obscurity' algorithms. Proper key management (Option B) is critical because the security of any cryptographic system relies entirely on keeping the keys secret and managing their lifecycle (generation, storage, rotation, and destruction) securely. Authenticated encryption, such as AES-GCM (Option C), provides both confidentiality and integrity/authenticity, preventing active tampering attacks (like bit-flipping) that standard encryption modes might be vulnerable to. MD5 (Option D) is cryptographically broken and insecure, and static IVs (Option E) destroy the semantic security of block ciphers, making them highly vulnerable to pattern analysis.

Answer

Hashing the data with MD5 for faster performance

Answer

Using a static IV for simplicity

Question 6

A security architect is reviewing a web application that handles sensitive financial transactions. The application uses a microservices architecture with an API gateway. During the threat modeling session using STRIDE, several threats were identified. Which TWO of the following are effective mitigations for the identified threats? (Select TWO.)

Accepted Answer

Implement generic error messages to users while logging detailed errors securely.. STRIDE includes Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. For the identified threat of Information Disclosure via verbose error messages, implementing generic error messages to users while logging detailed errors securely is the correct mitigation. For the threat of Tampering/Information Disclosure of data in transit between microservices, enforcing TLS encryption is the correct mitigation. While CSRF tokens mitigate Cross-Site Request Forgery (Tampering), they do not address the specific threats of verbose error messages or data in transit identified in the scenario.

Answer

Implement CSRF tokens for all state-changing requests.

Answer

Log all user credentials during authentication attempts for audit purposes.

Answer

Deploy a Web Application Firewall (WAF) to block all incoming traffic from unknown IP addresses.

Question 7

A security team is reviewing a web application that allows users to search for products. The application uses a SQL database and constructs queries by concatenating user input directly into the SQL statement. Which of the following is the most effective mitigation against SQL injection attacks?

Accepted Answer

Using parameterized queries with prepared statements. Parameterized queries with prepared statements separate SQL logic from user input by sending the query structure to the database first, then binding input values as data parameters. This prevents the database from interpreting user input as executable SQL code, even if the input contains malicious characters. It is the only defense that completely eliminates the injection vector at the database interaction layer.

Answer

Escaping all user input before concatenation

Answer

Input validation using a blacklist of known malicious patterns

Answer

Implementing a Web Application Firewall (WAF)

Question 8

During a threat modeling session for a new online banking application, the team uses the STRIDE methodology. Which threat category addresses the risk of an attacker modifying transaction data in transit?

Accepted Answer

Tampering. Tampering refers to the malicious modification of data. STRIDE's 'T' stands for Tampering.

Answer

Information Disclosure

Answer

Elevation of Privilege

Answer

Spoofing

Question 9

A development team is fixing a stored cross-site scripting (XSS) vulnerability in a web application that displays user comments. The application stores comments in a database and renders them in HTML. Which of the following is the most secure approach to prevent XSS?

Accepted Answer

Apply output encoding based on the context (e.g., HTML entity encoding). Output encoding (C) is the most secure approach because it neutralizes malicious scripts at the point of rendering, ensuring that user-controlled data is treated as text rather than executable code. For HTML contexts, HTML entity encoding (e.g., `<script>`) prevents the browser from interpreting injected tags, regardless of how the data was stored. This aligns with the defense-in-depth principle and is the primary mitigation for stored XSS as recommended by OWASP.

Answer

Use Content Security Policy (CSP) headers to restrict script execution

Answer

Sanitize input by removing all HTML tags before storing

Answer

Store comments in a separate domain to isolate them

Question 10

A security architect is designing a system that must continue to function even when a component fails. The architect implements multiple layers of security controls so that if one fails, others still provide protection. Which principle is being applied?

Accepted Answer

Defense in depth. Defense in depth (B) is the correct principle because it involves implementing multiple layers of security controls (e.g., firewalls, intrusion detection systems, encryption, access controls) so that if one layer fails or is bypassed, other layers continue to provide protection, ensuring the system remains functional. This directly matches the scenario where the architect designs for continued operation despite component failure by layering controls.

Answer

Separation of duties

Answer

Fail-secure

Answer

Least privilege

Question 11

During a penetration test, a security analyst discovers that a web application allows an attacker to bypass authorization and view another user's private messages by simply changing a numeric ID in the URL. Which vulnerability is being exploited?

Accepted Answer

Insecure direct object reference (IDOR). B is correct because the vulnerability allows an attacker to access another user's private messages by simply changing a numeric ID in the URL, which is a classic example of Insecure Direct Object Reference (IDOR). This occurs when the application exposes a direct reference to an internal object (e.g., a database key) without proper access control checks, enabling unauthorized access to resources belonging to other users.

Answer

Broken authentication

Answer

Server-side request forgery (SSRF)

Answer

Security misconfiguration

Question 12

A software development team is adopting secure coding practices. They decide to implement input validation for all user-supplied data. Which approach is recommended as the most effective for preventing injection attacks?

Accepted Answer

Whitelist validation to allow only known good patterns. Whitelist (allowlist) validation defines acceptable input patterns and rejects everything else, which is more effective than trying to block malicious patterns.

Answer

Encoding input before processing

Answer

Using regular expressions to sanitize input

Answer

Blacklist validation to block known malicious patterns

Question 13

An organization is migrating to a new application that uses serialized objects to transfer data between services. The security team is concerned about insecure deserialization attacks. Which of the following controls is most effective in preventing deserialization vulnerabilities?

Accepted Answer

Applying cryptographic integrity checks (e.g., HMAC) to serialized objects. Integrity checks (e.g., digital signatures) ensure that serialized data has not been tampered with, preventing malicious objects from being deserialized.

Answer

Implementing input validation on deserialized data

Answer

Using a allowlist of classes allowed to be deserialized

Answer

Running deserialization in a sandboxed environment

Question 14

A web application exposes an API that allows users to fetch data from internal network resources based on a URL parameter. An attacker discovers they can use this API to access internal servers that are not meant to be public. Which vulnerability is being exploited?

Accepted Answer

Server-side request forgery (SSRF). SSRF allows an attacker to induce the server to make requests to internal or external resources, bypassing firewalls and access controls.

Answer

Insecure direct object reference (IDOR)

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Question 15

A security analyst is reviewing the error handling of an application. The application currently displays detailed stack traces to users when an exception occurs. Which of the following is the best practice for error handling in production?

Accepted Answer

Display generic error messages to users and log detailed errors for admins. Detailed error messages can leak sensitive information. Production systems should show generic messages to users and log detailed errors for administrators.

Answer

Display detailed errors to users for troubleshooting

Answer

Disable all error reporting to eliminate information leakage

Answer

Encrypt error messages before displaying to users

Question 16

A development team is implementing cryptographic functions for a new application. They need to store passwords securely. Which of the following is the most appropriate approach?

Accepted Answer

Use a key derivation function (e.g., bcrypt) with a per-user salt. Passwords should be salted and hashed using a strong, slow hash function like bcrypt, scrypt, or PBKDF2. Salting prevents rainbow table attacks.

Answer

Encrypt passwords using AES-256 with a static key

Answer

Store passwords in plaintext but in a protected database

Answer

Hash passwords with SHA-256 without salt

Question 17

A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?

Accepted Answer

Vulnerable and Outdated Components. A is correct because the outdated CMS with known vulnerabilities directly corresponds to OWASP A06:2021 – Vulnerable and Outdated Components. This category covers using software versions with unpatched security flaws, which attackers can exploit via public exploit databases or automated scanners. B is correct because displaying detailed error messages and using default administrative credentials are classic examples of Security Misconfiguration (OWASP A05:2021). This occurs when security settings are not properly defined, implemented, or maintained, allowing attackers to gain information or unauthorized access.

Answer

Injection

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 18

During a security audit of a web application, the following issues are found: (1) Session tokens are included in URLs, (2) The application does not invalidate session tokens after logout, and (3) Session tokens are predictable. Which THREE of the following controls are most appropriate to address these issues?

Accepted Answer

Store session tokens in cookies with Secure and HttpOnly flags. Option B is correct because storing session tokens in cookies with Secure and HttpOnly flags addresses the issue of tokens being included in URLs by keeping them out of URLs and providing additional protections. Option C is correct because invalidating session tokens on logout and setting short expiration times directly addresses the lack of invalidation. Option D is correct because using a cryptographically secure random number generator directly addresses the predictability of session tokens. Option A is incorrect because regenerating session tokens after login is primarily a control against session fixation, not directly addressing predictability, exposure in URLs, or lack of invalidation. Option E is incorrect because IP address binding is fragile and does not protect against token exposure or poor invalidation.

Answer

Regenerate session tokens after login

Answer

Implement IP address binding for session tokens

Question 19

A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?

Accepted Answer

Interactive Application Security Testing (IAST). SAST (Static Application Security Testing) analyzes source code for vulnerabilities without executing it. IAST (Interactive Application Security Testing) combines SAST and DAST by instrumenting the application and analyzing runtime behavior. Both are suitable for development phase. DAST requires a running application, and penetration testing is usually done later.

Answer

Penetration testing

Answer

Vulnerability scanning

Answer

Dynamic Application Security Testing (DAST)

Question 20

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA