CISSP Software Development Security Practice Test 3 — 15 Questions

Question 1

During the requirements gathering phase of a secure SDLC, the team uses a threat modeling approach that focuses on identifying threats such as spoofing, tampering, and denial of service. Which threat modeling methodology is being employed?

Accepted Answer

STRIDE. STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Answer

PASTA

Answer

Trike

Answer

OCTAVE

Question 2

A security architect is designing an authentication system. To prevent session fixation attacks, which secure design principle should be implemented?

Accepted Answer

Regenerating session IDs after successful login. Session fixation attacks occur when an attacker forces a user to use a known session ID. Regenerating the session ID after successful login (e.g., via `session_regenerate_id()` in PHP or `HttpServletRequest.changeSessionId()` in Java) ensures that the pre-authentication session ID is discarded and a new, unpredictable one is issued, breaking the attacker's control.

Answer

Using HTTPS for all communications

Answer

Setting session timeout to 30 minutes

Answer

Implementing multi-factor authentication

Question 3

Which of the following is the primary purpose of output encoding in web application security?

Accepted Answer

Preventing cross-site scripting (XSS) attacks. Output encoding is the practice of converting special characters (e.g., <, >, &, ") into their corresponding HTML entities (e.g., < > & ") before sending data to the browser. This ensures that any user-supplied data is treated as text, not executable code, thereby neutralizing injected scripts. It is the primary defense against stored, reflected, and DOM-based cross-site scripting (XSS) attacks because it breaks the parser's ability to interpret the data as active content.

Answer

Preventing buffer overflow attacks

Answer

Preventing cross-site request forgery (CSRF)

Answer

Preventing SQL injection attacks

Question 4

During a security assessment, a penetration tester discovers that a web application exposes internal IP addresses in error messages. Which vulnerability category does this represent?

Accepted Answer

Security misconfiguration. Exposing internal IP addresses in error messages is a classic example of a security misconfiguration (C). The web application is likely configured to output detailed error messages (e.g., stack traces or debug information) that include internal network details, which should be suppressed in production environments. This violates the principle of least information disclosure and is categorized under security misconfiguration because it stems from improper default or runtime settings.

Answer

Broken access control

Answer

Sensitive data exposure

Answer

Insecure deserialization

Question 5

A development team is using a third-party library that is known to have a critical vulnerability. The team decides to continue using the library because it is widely used and the vulnerability has not been exploited. Which security risk is the team ignoring?

Accepted Answer

Using components with known vulnerabilities. The team is ignoring the risk of using components with known vulnerabilities, which is explicitly listed in the OWASP Top 10 (A06:2021). Even if a vulnerability has not been exploited yet, continuing to use a library with a known CVE (e.g., a remote code execution flaw in an older version of Log4j) exposes the application to potential attacks once exploit code becomes public. The decision based on 'wide usage' and 'no exploitation so far' is a fallacy, as threat actors often target widely deployed libraries precisely because of their large attack surface.

Answer

Insecure deserialization

Answer

Insufficient logging and monitoring

Answer

Security misconfiguration

Question 6

Which of the following is a secure coding practice to prevent SQL injection attacks?

Accepted Answer

Using parameterized queries. Parameterized queries (also known as prepared statements) separate SQL code from data by using placeholders (e.g., '?' in ODBC/JDBC or ':param' in Oracle) that are bound to user-supplied values at execution time. This ensures that input is always treated as data, never as executable SQL syntax, effectively neutralizing SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Validating input length

Question 7

A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?

Accepted Answer

Insecure direct object reference (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes direct references to internal objects (like user IDs) without proper access control checks. This allows an attacker to access other users' data by manipulating the ID.

Answer

Security misconfiguration

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 8

Which type of testing analyzes source code for security vulnerabilities without executing the program?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for known patterns, such as SQL injection or buffer overflow, using techniques like data flow analysis and taint tracking. This white-box approach identifies issues early in the Software Development Life Cycle (SDLC), making it the correct answer for testing that does not require runtime execution.

Answer

Interactive Application Security Testing (IAST)

Answer

Penetration testing

Answer

Dynamic Application Security Testing (DAST)

Question 9

A security engineer is evaluating a new third-party software component for use in a critical application. Which document is most important to review to understand the component's supply chain security?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components, libraries, and dependencies used in the software. It is essential for assessing supply chain risk and identifying known vulnerabilities.

Answer

End User License Agreement (EULA)

Answer

Service Level Agreement (SLA)

Answer

Data Processing Agreement (DPA)

Question 10

What is the primary purpose of a Web Application Firewall (WAF) in a deployment environment?

Accepted Answer

Filtering malicious HTTP traffic. A WAF filters, monitors, and blocks HTTP traffic to and from a web application. It helps protect against common web attacks like SQL injection, XSS, and CSRF by analyzing traffic at the application layer.

Answer

Encrypting all web traffic

Answer

Managing user authentication

Answer

Performing vulnerability scanning

Question 11

A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?

Accepted Answer

Enabling Content Security Policy (CSP). Output encoding ensures user input is treated as data, and Content Security Policy (CSP) restricts sources of executable scripts. Input validation can help but is not as effective alone; whitelist validation is emphasized, but output encoding and CSP are primary defenses.

Answer

Using CSRF tokens

Answer

Disabling client-side scripts entirely

Answer

Implementing parameterized queries

Question 12

A security team is performing a risk assessment on a legacy application that uses insecure deserialization. Which TWO of the following are recommended approaches to mitigate the risk of insecure deserialization?

Accepted Answer

Implementing integrity checks (e.g., digital signatures) on serialized objects. Option A is correct because implementing integrity checks, such as digital signatures, ensures that serialized objects have not been tampered with during transit or storage. This prevents an attacker from modifying the serialized data to inject malicious objects, which is a primary vector for insecure deserialization attacks. By verifying the signature before deserialization, the application can reject any object that does not match the expected integrity hash.

Answer

Encrypting the serialized data

Answer

Using generic exception handling to catch errors

Answer

Logging all deserialization attempts

Question 13

An organization is planning to acquire a new SaaS application for customer relationship management. Which THREE of the following should be included in the vendor security assessment?

Accepted Answer

Reviewing the vendor's security certifications (e.g., SOC 2, ISO 27001). Reviewing the vendor's security certifications (e.g., SOC 2), assessing their incident response process, and requesting a Software Bill of Materials (SBOM) are key steps. License compliance is important but not directly security, and employee training is internal to the vendor but less critical than the others.

Answer

Checking license compliance for open source components

Answer

Requiring employee security training records

Question 14

During a code review, a developer identifies that the application uses a custom encryption algorithm for storing sensitive data. Which THREE of the following are secure cryptographic practices that should be recommended instead?

Accepted Answer

Using industry-standard algorithms (e.g., AES-256). Option A is correct because using industry-standard algorithms like AES-256 ensures the encryption is based on publicly vetted, mathematically robust ciphers that have undergone extensive cryptanalysis. Custom encryption algorithms are highly risky as they lack peer review and often contain subtle flaws that can be exploited, whereas AES-256 is a NIST-approved symmetric block cipher with a 256-bit key size that provides strong confidentiality for sensitive data.

Answer

Hashing the data with MD5 for faster performance

Answer

Using a static IV for simplicity

Question 15

A security analyst is reviewing the authentication mechanism of a web application. Which TWO of the following are examples of broken authentication vulnerabilities?

Accepted Answer

Lack of multi-factor authentication for sensitive actions. Allowing weak passwords (e.g., 'password123') and not having multi-factor authentication (MFA) are broken authentication issues. Session timeout is a security control, not a vulnerability. Verbose error messages are a misconfiguration, and IDOR is an access control issue.

Answer

Insecure direct object reference in profile URLs

Answer

Verbose error messages disclosing user IDs

Answer

Session timeout set to 60 minutes