CISSP Software Development Security — Timed 15 Questions

Question 1

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

Accepted Answer

Design. Threat modeling is a structured activity that identifies potential threats, vulnerabilities, and attack vectors against a system. It is most effective during the Design phase because architectural decisions, data flow diagrams, trust boundaries, and component interactions are being defined, allowing security controls to be built in rather than bolted on later. Performing threat modeling here aligns with the 'shift left' principle of secure SDLC, reducing cost and effort compared to retrofitting security after implementation.

Answer

Implementation

Answer

Testing

Answer

Requirements gathering

Question 2

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Accepted Answer

Implement a Web Application Firewall (WAF) rule to block exploitation. Option D is correct because implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.

Answer

Remove the library from the codebase immediately

Answer

Disable the vulnerable feature in the library

Answer

Increase logging and monitoring to detect exploitation attempts

Question 3

During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:

String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";

Which of the following is the MOST effective remediation?

Accepted Answer

Replace the concatenated query with a prepared statement and bind parameters. Option D is correct because prepared statements with parameterized queries separate SQL logic from user input, preventing SQL injection entirely. In Java, using PreparedStatement with bind variables (e.g., `ps.setString(1, user)`) ensures the database treats input as data, not executable code, which is the only reliable defense against SQL injection attacks.

Answer

Use regular expressions to validate the username and password inputs

Answer

Encode the input using HTML entity encoding before inclusion in the query

Answer

Escape single quotes in the input parameters

Question 4

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

Accepted Answer

Security issues can be addressed incrementally throughout development. In Agile development, security testing and remediation are integrated into each iteration (sprint), allowing teams to identify and fix vulnerabilities incrementally rather than waiting until the end. This continuous feedback loop reduces the risk of late-stage security surprises and aligns with the principle of 'shifting left' on security.

Answer

Security testing is performed only at the end of the project

Answer

Security requirements are finalized upfront

Answer

Security documentation is minimized to reduce overhead

Question 5

A company is deploying a containerized application using Kubernetes. Which practice BEST ensures the security of the container images?

Accepted Answer

Scan images for vulnerabilities and use minimal base images. Scanning container images for known vulnerabilities (e.g., using Trivy, Clair, or Snyk) and using minimal base images (e.g., Alpine or distroless) directly reduces the attack surface and eliminates unnecessary packages that may contain exploitable flaws. This practice is foundational to secure software supply chain management and aligns with the principle of least functionality in containerized environments.

Answer

Restrict containers from running as root

Answer

Use the latest version of the base image without scanning

Answer

Enable container escape protection

Question 6

A development team is implementing a microservices architecture. Which of the following is the BEST approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) between services. Mutual TLS (mTLS) is the best approach because it provides both encryption and bidirectional authentication between services, ensuring that only authorized services can communicate. Unlike token-based methods, mTLS verifies the identity of both the client and server using X.509 certificates, which is critical in a zero-trust microservices environment where network boundaries are porous.

Answer

Use JSON Web Tokens (JWT) for each request

Answer

Use API keys transmitted in HTTP headers

Answer

Place all services behind a single API gateway

Question 7

Which TWO of the following are secure coding practices to prevent buffer overflow vulnerabilities? (Select TWO.)

Accepted Answer

Perform bounds checking on array indices and pointers. Bounds checking ensures that array indices and pointers do not reference memory outside the allocated buffer, directly preventing the overwrite of adjacent memory that leads to buffer overflows. This is a fundamental defensive coding practice that validates all input and index values before use.

Answer

Use dynamic memory allocation for all buffers

Answer

Enable Address Space Layout Randomization (ASLR)

Answer

Deallocate memory after use

Question 8

Which THREE of the following are valid techniques to ensure software integrity during the build and deployment process? (Select THREE.)

Accepted Answer

Using cryptographic hashes (e.g., SHA-256) to verify files. Cryptographic hashes like SHA-256 produce a unique fixed-size digest of a file's contents. By comparing the hash of a built artifact against a known-good hash, you can detect any unauthorized modification, corruption, or tampering that occurred during the build or deployment process. This directly ensures software integrity by verifying that the file has not been altered.

Answer

Implementing role-based access control on the build server

Answer

Continuous integration automated builds

Question 9

A financial services company uses a custom web application for online banking. The application is developed in-house using Java and deployed on Apache Tomcat servers. Recently, the security team discovered that the application is vulnerable to a critical remote code execution (RCE) vulnerability due to insecure deserialization of untrusted data. The vulnerability exists in a module that processes session objects. The development team has been assigned to fix this issue. They propose the following options:

A. Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.
B. Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.
C. Encrypt all serialized objects using AES-256 before sending them to the client.
D. Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

The application must maintain high availability and minimal latency. Which option provides the MOST effective and sustainable remediation?

Accepted Answer

Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.. Option A is correct because replacing Java serialization with JSON serialization (e.g., Jackson) and disabling polymorphic deserialization eliminates the root cause of insecure deserialization—Java's native serialization mechanism that automatically executes arbitrary code when deserializing untrusted data. JSON serialization with strict type handling prevents the attacker from injecting malicious objects, providing a sustainable fix without relying on fragile blacklists or encryption that doesn't address the vulnerability.

Answer

Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

Answer

Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.

Answer

Encrypt all serialized objects using AES-256 before sending them to the client.

Question 10

Drag and drop the steps for conducting a business impact analysis (BIA) in the correct order.

Question 11

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Question 12

Match each security model to its primary characteristic.

Question 13

Match each OSI layer to its function.

Question 14

A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?

Accepted Answer

Static Application Security Testing (SAST) in the build stage. Option B is correct because Static Application Security Testing (SAST) analyzes source code without execution, making it suitable for early detection in the build stage. Option A is wrong because DAST requires a running application. Option C is wrong because manual code review is too slow for continuous integration. Option D is wrong because relying solely on open-source tools may miss custom code flaws.

Answer

Only using open-source vulnerability scanners

Answer

Dynamic Application Security Testing (DAST) in the production stage

Answer

Manual code review after each sprint

Question 15

An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?

Accepted Answer

Include security requirements in user stories and conduct threat modeling each iteration. Option D is correct because iterative threat modeling and security user stories ensure security is part of each sprint. Option A is wrong because security only at release misses early flaws. Option B is wrong because skipping threat modeling increases risk. Option C is wrong because automated scans alone cannot replace threat modeling.

Answer

Perform a single security review at the end of the release cycle

Answer

Conduct security testing only during the integration phase

Answer

Skip threat modeling and rely solely on automated scanning