CISSP Software Development Security Practice Test 2 — 15 Questions

Question 1

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA

Question 2

A development team is implementing a web application that allows users to search for products. To prevent SQL injection attacks, which secure coding practice should be applied?

Accepted Answer

Parameterized queries with prepared statements. Parameterized queries with prepared statements (Option B) are the definitive defense against SQL injection because they separate SQL logic from user-supplied data. The database engine compiles the query structure first, then binds input values as parameters, ensuring that malicious input cannot alter the intended SQL command. This approach is language-agnostic and works across all modern database interfaces (e.g., JDBC, PDO, ADO.NET).

Answer

Input validation using a blacklist of SQL keywords

Answer

Output encoding of user input

Answer

Using stored procedures exclusively

Question 3

A security architect is reviewing a design for an e-commerce application. The architect recommends implementing defense in depth. Which of the following is an example of this principle?

Accepted Answer

Implementing both a web application firewall (WAF) and input validation. Defense in depth uses multiple layers of security controls so that if one fails, others still provide protection.

Answer

Encrypting data at rest only

Answer

Using a single firewall at the network perimeter

Answer

Requiring strong passwords for all users

Question 4

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 5

A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components and dependencies, aiding vulnerability management and supply chain security.

Answer

Service Level Agreement (SLA)

Answer

Data processing agreement

Answer

Vulnerability disclosure report

Question 6

During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?

Accepted Answer

Error handling. Error handling best practices dictate that generic error messages should be shown to users, while detailed errors (e.g., stack traces) should be logged internally to avoid information disclosure.

Answer

Input validation

Answer

Secure logging

Answer

Output encoding

Question 7

An application authenticates users using session tokens. A security analyst finds that the application does not invalidate session tokens after logout, allowing session fixation attacks. Which secure coding practice should be implemented to mitigate this?

Accepted Answer

Regenerating session ID after successful login. Proper session management includes invalidating session tokens on logout and generating new tokens after authentication to prevent fixation.

Answer

Using short session timeouts

Answer

Setting the secure flag on cookies

Answer

Implementing HTTPS for all communications

Question 8

A developer is implementing cryptographic storage for sensitive user data. Which of the following is a cryptographic best practice?

Accepted Answer

Using AES-256 in Galois/Counter Mode (GCM) for authenticated encryption. Industry-standard algorithms like AES-256 and SHA-256 are recommended, while MD5 and SHA-1 are deprecated due to weaknesses. Authenticated encryption (e.g., GCM) provides both confidentiality and integrity.

Answer

Using a static initialization vector (IV) for all encryption operations

Answer

Encrypting data with a hardcoded key in source code

Answer

Hashing passwords with MD5 for performance

Question 9

Which of the following is an example of an Insecure Direct Object Reference (IDOR) vulnerability?

Accepted Answer

An attacker changes the user ID parameter in a URL to view another user's profile. IDOR occurs when an application exposes a direct reference to an internal object (e.g., database key) and does not verify the user's authorization to access that object.

Answer

An attacker intercepts session cookies to impersonate a user

Answer

An attacker uses a SQL injection to retrieve data from the database

Answer

An attacker submits a cross-site request forgery (CSRF) token to perform actions

Question 10

A security team is conducting a penetration test on a web application. They identify that the application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the most effective mitigation?

Accepted Answer

Encoding all user-supplied data before reflecting it in the response. Option D is correct because reflecting user-supplied data without proper encoding allows an attacker to inject arbitrary HTML/JavaScript that executes in the victim's browser. Output encoding (e.g., HTML entity encoding for context like

Answer

Using HTTPS to encrypt traffic

Answer

Implementing a Content Security Policy (CSP) with strict directives

Answer

Validating input against a whitelist of allowed characters

Question 11

During a vulnerability assessment, a security analyst discovers that a web application uses a library known to be vulnerable to Log4Shell (CVE-2021-44228). Which type of vulnerability does this represent?

Accepted Answer

Vulnerable components. Log4Shell is a remote code execution vulnerability in the Log4j library, an example of using vulnerable components (third-party libraries with known vulnerabilities).

Answer

Server-side request forgery (SSRF)

Answer

Insecure deserialization

Answer

Security misconfiguration

Question 12

A development team is designing a new application and wants to ensure that if a failure occurs, the system remains secure by default. Which design principle should they apply?

Accepted Answer

Fail-secure. Fail-secure ensures that when a system fails, it defaults to a secure state (e.g., denying access) rather than an insecure one.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 13

A security analyst is reviewing a web application that handles financial transactions. Which TWO of the following are effective controls against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Setting cookies with the SameSite attribute to Strict. CSRF tokens are unique per request and validate the source, while SameSite cookies restrict cookie sending to same-site requests.

Answer

Using HTTPS for all pages

Answer

Enforcing strong password policies

Answer

Implementing input validation on all user inputs

Question 14

An organization is acquiring a third-party software product. Which THREE of the following should be included in the security assessment of the vendor?

Accepted Answer

Vulnerability scanning of dependencies. Reviewing the SBOM, vulnerability scanning of dependencies, and vendor security assessments are key elements of third-party security evaluation. Code signing is a deployment control, not assessment; license compliance is legal but not security-specific.

Answer

Verifying software license compliance

Answer

Ensuring code signing is used in the vendor's development process

Question 15

A security engineer is hardening a web server before deploying a new application. Which TWO of the following are examples of security misconfiguration vulnerabilities that should be addressed?

Accepted Answer

Default administrator credentials remain unchanged. Default administrator credentials are a classic security misconfiguration because they represent a failure to change vendor-supplied defaults before deployment. Attackers can easily guess or look up these credentials (e.g., admin:admin) to gain unauthorized access to the web server's management interface. This is explicitly listed in the OWASP Top 10 as a security misconfiguration (A05:2021).

Answer

Use of an outdated version of a JavaScript library with known vulnerabilities

Answer

Lack of CSRF tokens in forms

Answer

Weak password policy allowing short passwords