CISSP Software Development Security — Timed 20 Questions

Question 1

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

Accepted Answer

Design. Threat modeling is a structured activity that identifies potential threats, vulnerabilities, and attack vectors against a system. It is most effective during the Design phase because architectural decisions, data flow diagrams, trust boundaries, and component interactions are being defined, allowing security controls to be built in rather than bolted on later. Performing threat modeling here aligns with the 'shift left' principle of secure SDLC, reducing cost and effort compared to retrofitting security after implementation.

Answer

Implementation

Answer

Testing

Answer

Requirements gathering

Question 2

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Accepted Answer

Implement a Web Application Firewall (WAF) rule to block exploitation. Option D is correct because implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.

Answer

Remove the library from the codebase immediately

Answer

Disable the vulnerable feature in the library

Answer

Increase logging and monitoring to detect exploitation attempts

Question 3

During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:

String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";

Which of the following is the MOST effective remediation?

Accepted Answer

Replace the concatenated query with a prepared statement and bind parameters. Option D is correct because prepared statements with parameterized queries separate SQL logic from user input, preventing SQL injection entirely. In Java, using PreparedStatement with bind variables (e.g., `ps.setString(1, user)`) ensures the database treats input as data, not executable code, which is the only reliable defense against SQL injection attacks.

Answer

Use regular expressions to validate the username and password inputs

Answer

Encode the input using HTML entity encoding before inclusion in the query

Answer

Escape single quotes in the input parameters

Question 4

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

Accepted Answer

Security issues can be addressed incrementally throughout development. In Agile development, security testing and remediation are integrated into each iteration (sprint), allowing teams to identify and fix vulnerabilities incrementally rather than waiting until the end. This continuous feedback loop reduces the risk of late-stage security surprises and aligns with the principle of 'shifting left' on security.

Answer

Security testing is performed only at the end of the project

Answer

Security requirements are finalized upfront

Answer

Security documentation is minimized to reduce overhead

Question 5

A company is deploying a containerized application using Kubernetes. Which practice BEST ensures the security of the container images?

Accepted Answer

Scan images for vulnerabilities and use minimal base images. Scanning container images for known vulnerabilities (e.g., using Trivy, Clair, or Snyk) and using minimal base images (e.g., Alpine or distroless) directly reduces the attack surface and eliminates unnecessary packages that may contain exploitable flaws. This practice is foundational to secure software supply chain management and aligns with the principle of least functionality in containerized environments.

Answer

Restrict containers from running as root

Answer

Use the latest version of the base image without scanning

Answer

Enable container escape protection

Question 6

A development team is implementing a microservices architecture. Which of the following is the BEST approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) between services. Mutual TLS (mTLS) is the best approach because it provides both encryption and bidirectional authentication between services, ensuring that only authorized services can communicate. Unlike token-based methods, mTLS verifies the identity of both the client and server using X.509 certificates, which is critical in a zero-trust microservices environment where network boundaries are porous.

Answer

Use JSON Web Tokens (JWT) for each request

Answer

Use API keys transmitted in HTTP headers

Answer

Place all services behind a single API gateway

Question 7

Which TWO of the following are secure coding practices to prevent buffer overflow vulnerabilities? (Select TWO.)

Accepted Answer

Perform bounds checking on array indices and pointers. Bounds checking ensures that array indices and pointers do not reference memory outside the allocated buffer, directly preventing the overwrite of adjacent memory that leads to buffer overflows. This is a fundamental defensive coding practice that validates all input and index values before use.

Answer

Use dynamic memory allocation for all buffers

Answer

Enable Address Space Layout Randomization (ASLR)

Answer

Deallocate memory after use

Question 8

Which THREE of the following are valid techniques to ensure software integrity during the build and deployment process? (Select THREE.)

Accepted Answer

Using cryptographic hashes (e.g., SHA-256) to verify files. Cryptographic hashes like SHA-256 produce a unique fixed-size digest of a file's contents. By comparing the hash of a built artifact against a known-good hash, you can detect any unauthorized modification, corruption, or tampering that occurred during the build or deployment process. This directly ensures software integrity by verifying that the file has not been altered.

Answer

Implementing role-based access control on the build server

Answer

Continuous integration automated builds

Question 9

A financial services company uses a custom web application for online banking. The application is developed in-house using Java and deployed on Apache Tomcat servers. Recently, the security team discovered that the application is vulnerable to a critical remote code execution (RCE) vulnerability due to insecure deserialization of untrusted data. The vulnerability exists in a module that processes session objects. The development team has been assigned to fix this issue. They propose the following options:

A. Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.
B. Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.
C. Encrypt all serialized objects using AES-256 before sending them to the client.
D. Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

The application must maintain high availability and minimal latency. Which option provides the MOST effective and sustainable remediation?

Accepted Answer

Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.. Option A is correct because replacing Java serialization with JSON serialization (e.g., Jackson) and disabling polymorphic deserialization eliminates the root cause of insecure deserialization—Java's native serialization mechanism that automatically executes arbitrary code when deserializing untrusted data. JSON serialization with strict type handling prevents the attacker from injecting malicious objects, providing a sustainable fix without relying on fragile blacklists or encryption that doesn't address the vulnerability.

Answer

Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

Answer

Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.

Answer

Encrypt all serialized objects using AES-256 before sending them to the client.

Question 10

Drag and drop the steps for conducting a business impact analysis (BIA) in the correct order.

Question 11

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Question 12

Match each security model to its primary characteristic.

Question 13

Match each OSI layer to its function.

Question 14

A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?

Accepted Answer

Static Application Security Testing (SAST) in the build stage. Option B is correct because Static Application Security Testing (SAST) analyzes source code without execution, making it suitable for early detection in the build stage. Option A is wrong because DAST requires a running application. Option C is wrong because manual code review is too slow for continuous integration. Option D is wrong because relying solely on open-source tools may miss custom code flaws.

Answer

Only using open-source vulnerability scanners

Answer

Dynamic Application Security Testing (DAST) in the production stage

Answer

Manual code review after each sprint

Question 15

An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?

Accepted Answer

Include security requirements in user stories and conduct threat modeling each iteration. Option D is correct because iterative threat modeling and security user stories ensure security is part of each sprint. Option A is wrong because security only at release misses early flaws. Option B is wrong because skipping threat modeling increases risk. Option C is wrong because automated scans alone cannot replace threat modeling.

Answer

Perform a single security review at the end of the release cycle

Answer

Conduct security testing only during the integration phase

Answer

Skip threat modeling and rely solely on automated scanning

Question 16

In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) and identity-based access policies. Option A is correct because mutual TLS (mTLS) with identity-based policies authenticates and encrypts each service-to-service call. Option B is wrong because TLS alone does not authenticate the caller. Option C is wrong because API keys are less secure and harder to manage at scale. Option D is wrong because network segmentation without encryption does not protect against eavesdropping.

Answer

Segment services into separate VLANs without encryption

Answer

Use TLS only for all communication

Answer

Rely on API keys in the request headers

Question 17

Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)

Accepted Answer

Use parameterized queries or prepared statements. Options A and D are correct. Input validation ensures data conforms to expected patterns; parameterized queries separate code from data. Option B is wrong because encoding outputs is for XSS, not injection. Option C is wrong because error messages should not reveal internal details. Option E is wrong because encryption does not prevent injection.

Answer

Encode output to the browser

Answer

Encrypt sensitive input data

Answer

Use custom error messages that detail the failure

Question 18

Which THREE of the following are essential components of a software supply chain security program? (Select exactly three.)

Accepted Answer

Using signed and verified software artifacts. Options B, C, and E are correct. SBOMs provide transparency; vendor assessments ensure third-party security; signed artifacts verify integrity. Option A is wrong because static analysis is internal, not supply chain. Option D is wrong because penetration tests are broader, not specifically supply chain.

Answer

Running penetration tests on the production environment

Answer

Conducting static analysis on all in-house code

Question 19

Which TWO of the following are fundamental phases of a secure software development lifecycle (SSDLC) where security should be integrated? (Select exactly two.)

Accepted Answer

Testing and validation. Options C and E are correct. Security requirements must be defined early; security testing should be performed before deployment. Option A is wrong because production operations are post-deployment. Option B is wrong because retirement is final. Option D is wrong because it is too late.

Answer

Software retirement

Answer

User acceptance testing

Answer

Production operations

Question 20

Refer to the exhibit. Which security weakness should be addressed first in this Dockerfile?

Accepted Answer

The container runs as root by default. Option C is correct because running as root inside the container increases the impact of a compromise. Option A is wrong because Python itself is not a weakness. Option B is wrong because pinning base image tags is important but less critical than running as root. Option D is wrong because multistage builds are a best practice but not the most urgent issue.

Answer

Installing Python without version pinning

Answer

No multistage build is used

Answer

The use of 'latest' tag for the base image