CISSP Software Development Security — Timed 20 Questions

Question 1

A security team is reviewing a web application that allows users to search for products. The application uses a SQL database and constructs queries by concatenating user input directly into the SQL statement. Which of the following is the most effective mitigation against SQL injection attacks?

Accepted Answer

Using parameterized queries with prepared statements. Parameterized queries with prepared statements separate SQL logic from user input by sending the query structure to the database first, then binding input values as data parameters. This prevents the database from interpreting user input as executable SQL code, even if the input contains malicious characters. It is the only defense that completely eliminates the injection vector at the database interaction layer.

Answer

Escaping all user input before concatenation

Answer

Input validation using a blacklist of known malicious patterns

Answer

Implementing a Web Application Firewall (WAF)

Question 2

During a threat modeling session for a new online banking application, the team uses the STRIDE methodology. Which threat category addresses the risk of an attacker modifying transaction data in transit?

Accepted Answer

Tampering. Tampering refers to the malicious modification of data. STRIDE's 'T' stands for Tampering.

Answer

Information Disclosure

Answer

Elevation of Privilege

Answer

Spoofing

Question 3

A development team is fixing a stored cross-site scripting (XSS) vulnerability in a web application that displays user comments. The application stores comments in a database and renders them in HTML. Which of the following is the most secure approach to prevent XSS?

Accepted Answer

Apply output encoding based on the context (e.g., HTML entity encoding). Output encoding (C) is the most secure approach because it neutralizes malicious scripts at the point of rendering, ensuring that user-controlled data is treated as text rather than executable code. For HTML contexts, HTML entity encoding (e.g., `<script>`) prevents the browser from interpreting injected tags, regardless of how the data was stored. This aligns with the defense-in-depth principle and is the primary mitigation for stored XSS as recommended by OWASP.

Answer

Use Content Security Policy (CSP) headers to restrict script execution

Answer

Sanitize input by removing all HTML tags before storing

Answer

Store comments in a separate domain to isolate them

Question 4

A security architect is designing a system that must continue to function even when a component fails. The architect implements multiple layers of security controls so that if one fails, others still provide protection. Which principle is being applied?

Accepted Answer

Defense in depth. Defense in depth (B) is the correct principle because it involves implementing multiple layers of security controls (e.g., firewalls, intrusion detection systems, encryption, access controls) so that if one layer fails or is bypassed, other layers continue to provide protection, ensuring the system remains functional. This directly matches the scenario where the architect designs for continued operation despite component failure by layering controls.

Answer

Separation of duties

Answer

Fail-secure

Answer

Least privilege

Question 5

During a penetration test, a security analyst discovers that a web application allows an attacker to bypass authorization and view another user's private messages by simply changing a numeric ID in the URL. Which vulnerability is being exploited?

Accepted Answer

Insecure direct object reference (IDOR). B is correct because the vulnerability allows an attacker to access another user's private messages by simply changing a numeric ID in the URL, which is a classic example of Insecure Direct Object Reference (IDOR). This occurs when the application exposes a direct reference to an internal object (e.g., a database key) without proper access control checks, enabling unauthorized access to resources belonging to other users.

Answer

Broken authentication

Answer

Server-side request forgery (SSRF)

Answer

Security misconfiguration

Question 6

A software development team is adopting secure coding practices. They decide to implement input validation for all user-supplied data. Which approach is recommended as the most effective for preventing injection attacks?

Accepted Answer

Whitelist validation to allow only known good patterns. Whitelist (allowlist) validation defines acceptable input patterns and rejects everything else, which is more effective than trying to block malicious patterns.

Answer

Encoding input before processing

Answer

Using regular expressions to sanitize input

Answer

Blacklist validation to block known malicious patterns

Question 7

A security team is reviewing a newly acquired third-party software component. They want to ensure that the component's supply chain is secure and that known vulnerabilities are identified. Which of the following tools provides a list of all open-source and third-party components used in the software?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) is a formal record containing the details and supply chain relationships of components used in building software.

Answer

Vulnerability scanner

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Question 8

A developer is implementing authentication for a new application. To protect against brute-force attacks, the developer decides to implement account lockout after a certain number of failed attempts. Which security principle does this control enforce?

Accepted Answer

Strong authentication. Account lockout after failed attempts reduces the feasibility of brute-force attacks, enforcing strong authentication mechanisms.

Answer

Fail-secure

Answer

Defense in depth

Answer

Least privilege

Question 9

An organization is migrating to a new application that uses serialized objects to transfer data between services. The security team is concerned about insecure deserialization attacks. Which of the following controls is most effective in preventing deserialization vulnerabilities?

Accepted Answer

Applying cryptographic integrity checks (e.g., HMAC) to serialized objects. Integrity checks (e.g., digital signatures) ensure that serialized data has not been tampered with, preventing malicious objects from being deserialized.

Answer

Implementing input validation on deserialized data

Answer

Using a allowlist of classes allowed to be deserialized

Answer

Running deserialization in a sandboxed environment

Question 10

A web application exposes an API that allows users to fetch data from internal network resources based on a URL parameter. An attacker discovers they can use this API to access internal servers that are not meant to be public. Which vulnerability is being exploited?

Accepted Answer

Server-side request forgery (SSRF). SSRF allows an attacker to induce the server to make requests to internal or external resources, bypassing firewalls and access controls.

Answer

Insecure direct object reference (IDOR)

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Question 11

A security analyst is reviewing the error handling of an application. The application currently displays detailed stack traces to users when an exception occurs. Which of the following is the best practice for error handling in production?

Accepted Answer

Display generic error messages to users and log detailed errors for admins. Detailed error messages can leak sensitive information. Production systems should show generic messages to users and log detailed errors for administrators.

Answer

Display detailed errors to users for troubleshooting

Answer

Disable all error reporting to eliminate information leakage

Answer

Encrypt error messages before displaying to users

Question 12

A development team is implementing cryptographic functions for a new application. They need to store passwords securely. Which of the following is the most appropriate approach?

Accepted Answer

Use a key derivation function (e.g., bcrypt) with a per-user salt. Passwords should be salted and hashed using a strong, slow hash function like bcrypt, scrypt, or PBKDF2. Salting prevents rainbow table attacks.

Answer

Encrypt passwords using AES-256 with a static key

Answer

Store passwords in plaintext but in a protected database

Answer

Hash passwords with SHA-256 without salt

Question 13

A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?

Accepted Answer

Vulnerable and Outdated Components. A is correct because the outdated CMS with known vulnerabilities directly corresponds to OWASP A06:2021 – Vulnerable and Outdated Components. This category covers using software versions with unpatched security flaws, which attackers can exploit via public exploit databases or automated scanners.

Answer

Injection

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 14

During a security audit of a web application, the following issues are found: (1) Session tokens are included in URLs, (2) The application does not invalidate session tokens after logout, and (3) Session tokens are predictable. Which THREE of the following controls are most appropriate to address these issues?

Accepted Answer

Regenerate session tokens after login. Option A is correct because regenerating session tokens after login prevents session fixation attacks, where an attacker forces a known session ID on a user before authentication. This ensures that the session identifier used post-login is not the same as the one used pre-login, mitigating the risk of an attacker hijacking the authenticated session. This control directly addresses the issue of predictable session tokens by ensuring a fresh, unpredictable token is issued upon authentication.

Answer

Implement IP address binding for session tokens

Question 15

A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?

Accepted Answer

Interactive Application Security Testing (IAST). SAST (Static Application Security Testing) analyzes source code for vulnerabilities without executing it. IAST (Interactive Application Security Testing) combines SAST and DAST by instrumenting the application and analyzing runtime behavior. Both are suitable for development phase. DAST requires a running application, and penetration testing is usually done later.

Answer

Penetration testing

Answer

Vulnerability scanning

Answer

Dynamic Application Security Testing (DAST)

Question 16

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA

Question 17

A development team is implementing a web application that allows users to search for products. To prevent SQL injection attacks, which secure coding practice should be applied?

Accepted Answer

Parameterized queries with prepared statements. Parameterized queries with prepared statements (Option B) are the definitive defense against SQL injection because they separate SQL logic from user-supplied data. The database engine compiles the query structure first, then binds input values as parameters, ensuring that malicious input cannot alter the intended SQL command. This approach is language-agnostic and works across all modern database interfaces (e.g., JDBC, PDO, ADO.NET).

Answer

Input validation using a blacklist of SQL keywords

Answer

Output encoding of user input

Answer

Using stored procedures exclusively

Question 18

A security architect is reviewing a design for an e-commerce application. The architect recommends implementing defense in depth. Which of the following is an example of this principle?

Accepted Answer

Implementing both a web application firewall (WAF) and input validation. Defense in depth uses multiple layers of security controls so that if one fails, others still provide protection.

Answer

Encrypting data at rest only

Answer

Using a single firewall at the network perimeter

Answer

Requiring strong passwords for all users

Question 19

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 20

A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components and dependencies, aiding vulnerability management and supply chain security.

Answer

Service Level Agreement (SLA)

Answer

Data processing agreement

Answer

Vulnerability disclosure report