CISSP Software Development Security Practice Test 2 — 15 Questions

Question 1

A development team is implementing cryptographic functions for a new application. They need to store passwords securely. Which of the following is the most appropriate approach?

Accepted Answer

Use a key derivation function (e.g., bcrypt) with a per-user salt. Passwords should be salted and hashed using a strong, slow hash function like bcrypt, scrypt, or PBKDF2. Salting prevents rainbow table attacks.

Answer

Encrypt passwords using AES-256 with a static key

Answer

Store passwords in plaintext but in a protected database

Answer

Hash passwords with SHA-256 without salt

Question 2

A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?

Accepted Answer

Vulnerable and Outdated Components. A is correct because the outdated CMS with known vulnerabilities directly corresponds to OWASP A06:2021 – Vulnerable and Outdated Components. This category covers using software versions with unpatched security flaws, which attackers can exploit via public exploit databases or automated scanners. B is correct because displaying detailed error messages and using default administrative credentials are classic examples of Security Misconfiguration (OWASP A05:2021). This occurs when security settings are not properly defined, implemented, or maintained, allowing attackers to gain information or unauthorized access.

Answer

Injection

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 3

During a security audit of a web application, the following issues are found: (1) Session tokens are included in URLs, (2) The application does not invalidate session tokens after logout, and (3) Session tokens are predictable. Which THREE of the following controls are most appropriate to address these issues?

Accepted Answer

Store session tokens in cookies with Secure and HttpOnly flags. Option B is correct because storing session tokens in cookies with Secure and HttpOnly flags addresses the issue of tokens being included in URLs by keeping them out of URLs and providing additional protections. Option C is correct because invalidating session tokens on logout and setting short expiration times directly addresses the lack of invalidation. Option D is correct because using a cryptographically secure random number generator directly addresses the predictability of session tokens. Option A is incorrect because regenerating session tokens after login is primarily a control against session fixation, not directly addressing predictability, exposure in URLs, or lack of invalidation. Option E is incorrect because IP address binding is fragile and does not protect against token exposure or poor invalidation.

Answer

Regenerate session tokens after login

Answer

Implement IP address binding for session tokens

Question 4

A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?

Accepted Answer

Interactive Application Security Testing (IAST). SAST (Static Application Security Testing) analyzes source code for vulnerabilities without executing it. IAST (Interactive Application Security Testing) combines SAST and DAST by instrumenting the application and analyzing runtime behavior. Both are suitable for development phase. DAST requires a running application, and penetration testing is usually done later.

Answer

Penetration testing

Answer

Vulnerability scanning

Answer

Dynamic Application Security Testing (DAST)

Question 5

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA

Question 6

A development team is implementing a web application that allows users to search for products. To prevent SQL injection attacks, which secure coding practice should be applied?

Accepted Answer

Parameterized queries with prepared statements. Parameterized queries with prepared statements (Option B) are the definitive defense against SQL injection because they separate SQL logic from user-supplied data. The database engine compiles the query structure first, then binds input values as parameters, ensuring that malicious input cannot alter the intended SQL command. This approach is language-agnostic and works across all modern database interfaces (e.g., JDBC, PDO, ADO.NET).

Answer

Input validation using a blacklist of SQL keywords

Answer

Output encoding of user input

Answer

Using stored procedures exclusively

Question 7

A security architect is reviewing a design for an e-commerce application. The architect recommends implementing defense in depth. Which of the following is an example of this principle?

Accepted Answer

Implementing both a web application firewall (WAF) and input validation. Defense in depth uses multiple layers of security controls so that if one fails, others still provide protection.

Answer

Encrypting data at rest only

Answer

Using a single firewall at the network perimeter

Answer

Requiring strong passwords for all users

Question 8

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 9

A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components and dependencies, aiding vulnerability management and supply chain security.

Answer

Service Level Agreement (SLA)

Answer

Data processing agreement

Answer

Vulnerability disclosure report

Question 10

During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?

Accepted Answer

Error handling. Error handling best practices dictate that generic error messages should be shown to users, while detailed errors (e.g., stack traces) should be logged internally to avoid information disclosure.

Answer

Input validation

Answer

Secure logging

Answer

Output encoding

Question 11

An application authenticates users using session tokens. A security analyst finds that the application does not invalidate session tokens after logout, allowing session fixation attacks. Which secure coding practice should be implemented to mitigate this?

Accepted Answer

Regenerating session ID after successful login. Proper session management includes invalidating session tokens on logout and generating new tokens after authentication to prevent fixation.

Answer

Using short session timeouts

Answer

Setting the secure flag on cookies

Answer

Implementing HTTPS for all communications

Question 12

A developer is implementing cryptographic storage for sensitive user data. Which of the following is a cryptographic best practice?

Accepted Answer

Using AES-256 in Galois/Counter Mode (GCM) for authenticated encryption. Industry-standard algorithms like AES-256 and SHA-256 are recommended, while MD5 and SHA-1 are deprecated due to weaknesses. Authenticated encryption (e.g., GCM) provides both confidentiality and integrity.

Answer

Using a static initialization vector (IV) for all encryption operations

Answer

Encrypting data with a hardcoded key in source code

Answer

Hashing passwords with MD5 for performance

Question 13

Which of the following is an example of an Insecure Direct Object Reference (IDOR) vulnerability?

Accepted Answer

An attacker changes the user ID parameter in a URL to view another user's profile. IDOR occurs when an application exposes a direct reference to an internal object (e.g., database key) and does not verify the user's authorization to access that object.

Answer

An attacker intercepts session cookies to impersonate a user

Answer

An attacker uses a SQL injection to retrieve data from the database

Answer

An attacker submits a cross-site request forgery (CSRF) token to perform actions

Question 14

A security team is conducting a penetration test on a web application. They identify that the application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the most effective mitigation?

Accepted Answer

Encoding all user-supplied data before reflecting it in the response. Reflecting user-supplied data without proper encoding allows an attacker to inject arbitrary HTML/JavaScript that executes in the victim's browser. Output encoding (e.g., HTML entity encoding for context like

Answer

Using HTTPS to encrypt traffic

Answer

Implementing a Content Security Policy (CSP) with strict directives

Answer

Validating input against a whitelist of allowed characters

Question 15

During a vulnerability assessment, a security analyst discovers that a web application uses a library known to be vulnerable to Log4Shell (CVE-2021-44228). Which type of vulnerability does this represent?

Accepted Answer

Vulnerable components. Log4Shell is a remote code execution vulnerability in the Log4j library, an example of using vulnerable components (third-party libraries with known vulnerabilities).

Answer

Server-side request forgery (SSRF)

Answer

Insecure deserialization

Answer

Security misconfiguration