CISSP Software Development Security Practice Test 3 — 15 Questions

Question 1

A development team is designing a new application and wants to ensure that if a failure occurs, the system remains secure by default. Which design principle should they apply?

Accepted Answer

Fail-secure. Fail-secure ensures that when a system fails, it defaults to a secure state (e.g., denying access) rather than an insecure one.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 2

A security analyst is reviewing a web application that handles financial transactions. Which TWO of the following are effective controls against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Setting cookies with the SameSite attribute to Strict. CSRF tokens are unique per request and validate the source, while SameSite cookies restrict cookie sending to same-site requests.

Answer

Using HTTPS for all pages

Answer

Enforcing strong password policies

Answer

Implementing input validation on all user inputs

Question 3

An organization is acquiring a third-party software product. Which THREE of the following should be included in the security assessment of the vendor?

Accepted Answer

Vulnerability scanning of dependencies. Reviewing the SBOM, vulnerability scanning of dependencies, and vendor security assessments are key elements of third-party security evaluation. Code signing is a deployment control, not assessment; license compliance is legal but not security-specific.

Answer

Verifying software license compliance

Answer

Ensuring code signing is used in the vendor's development process

Question 4

During the requirements gathering phase of a secure SDLC, the team uses a threat modeling approach that focuses on identifying threats such as spoofing, tampering, and denial of service. Which threat modeling methodology is being employed?

Accepted Answer

STRIDE. STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Answer

PASTA

Answer

Trike

Answer

OCTAVE

Question 5

A security architect is designing an authentication system. To prevent session fixation attacks, which secure design principle should be implemented?

Accepted Answer

Regenerating session IDs after successful login. Session fixation attacks occur when an attacker forces a user to use a known session ID. Regenerating the session ID after successful login (e.g., via `session_regenerate_id()` in PHP or `HttpServletRequest.changeSessionId()` in Java) ensures that the pre-authentication session ID is discarded and a new, unpredictable one is issued, breaking the attacker's control.

Answer

Using HTTPS for all communications

Answer

Setting session timeout to 30 minutes

Answer

Implementing multi-factor authentication

Question 6

Which of the following is the primary purpose of output encoding in web application security?

Accepted Answer

Preventing cross-site scripting (XSS) attacks. Output encoding is the practice of converting special characters (e.g., <, >, &, ") into their corresponding HTML entities (e.g., < > & ") before sending data to the browser. This ensures that any user-supplied data is treated as text, not executable code, thereby neutralizing injected scripts. It is the primary defense against stored, reflected, and DOM-based cross-site scripting (XSS) attacks because it breaks the parser's ability to interpret the data as active content.

Answer

Preventing buffer overflow attacks

Answer

Preventing cross-site request forgery (CSRF)

Answer

Preventing SQL injection attacks

Question 7

During a security assessment, a penetration tester discovers that a web application exposes internal IP addresses in error messages. Which vulnerability category does this represent?

Accepted Answer

Security misconfiguration. Exposing internal IP addresses in error messages is a classic example of a security misconfiguration (C). The web application is likely configured to output detailed error messages (e.g., stack traces or debug information) that include internal network details, which should be suppressed in production environments. This violates the principle of least information disclosure and is categorized under security misconfiguration because it stems from improper default or runtime settings.

Answer

Broken access control

Answer

Sensitive data exposure

Answer

Insecure deserialization

Question 8

A development team is using a third-party library that is known to have a critical vulnerability. The team decides to continue using the library because it is widely used and the vulnerability has not been exploited. Which security risk is the team ignoring?

Accepted Answer

Using components with known vulnerabilities. The team is ignoring the risk of using components with known vulnerabilities, which is explicitly listed in the OWASP Top 10 (A06:2021). Even if a vulnerability has not been exploited yet, continuing to use a library with a known CVE (e.g., a remote code execution flaw in an older version of Log4j) exposes the application to potential attacks once exploit code becomes public. The decision based on 'wide usage' and 'no exploitation so far' is a fallacy, as threat actors often target widely deployed libraries precisely because of their large attack surface.

Answer

Insecure deserialization

Answer

Insufficient logging and monitoring

Answer

Security misconfiguration

Question 9

Which of the following is a secure coding practice to prevent SQL injection attacks?

Accepted Answer

Using parameterized queries. Parameterized queries (also known as prepared statements) separate SQL code from data by using placeholders (e.g., '?' in ODBC/JDBC or ':param' in Oracle) that are bound to user-supplied values at execution time. This ensures that input is always treated as data, never as executable SQL syntax, effectively neutralizing SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Validating input length

Question 10

A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?

Accepted Answer

Insecure direct object reference (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes direct references to internal objects (like user IDs) without proper access control checks. This allows an attacker to access other users' data by manipulating the ID.

Answer

Security misconfiguration

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 11

Which type of testing analyzes source code for security vulnerabilities without executing the program?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for known patterns, such as SQL injection or buffer overflow, using techniques like data flow analysis and taint tracking. This white-box approach identifies issues early in the Software Development Life Cycle (SDLC), making it the correct answer for testing that does not require runtime execution.

Answer

Interactive Application Security Testing (IAST)

Answer

Penetration testing

Answer

Dynamic Application Security Testing (DAST)

Question 12

A security engineer is evaluating a new third-party software component for use in a critical application. Which document is most important to review to understand the component's supply chain security?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components, libraries, and dependencies used in the software. It is essential for assessing supply chain risk and identifying known vulnerabilities.

Answer

End User License Agreement (EULA)

Answer

Service Level Agreement (SLA)

Answer

Data Processing Agreement (DPA)

Question 13

What is the primary purpose of a Web Application Firewall (WAF) in a deployment environment?

Accepted Answer

Filtering malicious HTTP traffic. A WAF filters, monitors, and blocks HTTP traffic to and from a web application. It helps protect against common web attacks like SQL injection, XSS, and CSRF by analyzing traffic at the application layer.

Answer

Encrypting all web traffic

Answer

Managing user authentication

Answer

Performing vulnerability scanning

Question 14

A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?

Accepted Answer

Enabling Content Security Policy (CSP). Output encoding ensures user input is treated as data, and Content Security Policy (CSP) restricts sources of executable scripts. Input validation can help but is not as effective alone; whitelist validation is emphasized, but output encoding and CSP are primary defenses.

Answer

Using CSRF tokens

Answer

Disabling client-side scripts entirely

Answer

Implementing parameterized queries

Question 15

An organization is planning to acquire a new SaaS application for customer relationship management. Which THREE of the following should be included in the vendor security assessment?

Accepted Answer

Reviewing the vendor's security certifications (e.g., SOC 2, ISO 27001). Reviewing the vendor's security certifications (e.g., SOC 2), assessing their incident response process, and requesting a Software Bill of Materials (SBOM) are key steps. License compliance is important but not directly security, and employee training is internal to the vendor but less critical than the others.

Answer

Checking license compliance for open source components

Answer

Requiring employee security training records