20+ practice questions focused on Software Development Security — one of the most tested topics on the Certified Information Systems Security Professional CISSP exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Software Development Security PracticeA security team is reviewing a newly acquired third-party software component. They want to ensure that the component's supply chain is secure and that known vulnerabilities are identified. Which of the following tools provides a list of all open-source and third-party components used in the software?
Explanation: A Software Bill of Materials (SBOM) is a formal, structured record (an inventory) containing the details and supply chain relationships of components used in building software. Software Composition Analysis (SCA) is the tool category used to analyze the software and generate this list.
A developer is implementing authentication for a new application. To protect against brute-force attacks, the developer decides to implement account lockout after a certain number of failed attempts. Which security principle does this control enforce?
Explanation: Account lockout is an implementation of the 'fail-secure' (or fail-closed) principle. When a threshold of failed login attempts is reached (representing a failure of the authentication process or a potential attack), the system transitions to a secure state by blocking further access attempts to that account until it is explicitly unlocked by an administrator or a cooldown period expires.
A security engineer is hardening a web server before deploying a new application. Which TWO of the following are examples of security misconfiguration vulnerabilities that should be addressed?
Explanation: Default administrator credentials are a classic security misconfiguration because they represent a failure to change vendor-supplied defaults before deployment. Attackers can easily guess or look up these credentials to gain unauthorized access to the web server's management interface. Verbose error messages revealing stack traces to users is also a security misconfiguration. Proper error handling should be configured to display generic error messages to users while logging detailed stack traces securely on the server side. Revealing stack traces can expose underlying technologies, database structures, and code paths, aiding attackers in crafting targeted exploits. Both of these are explicitly listed under OWASP Top 10 A05:2021 - Security Misconfiguration.
A security team is performing a risk assessment on a legacy application that uses insecure deserialization. Which TWO of the following are recommended approaches to mitigate the risk of insecure deserialization?
Explanation: Implementing integrity checks, such as digital signatures, ensures that serialized objects have not been tampered with during transit or storage. This prevents an attacker from modifying the serialized data to inject malicious payloads. Additionally, using allow lists (or look-ahead deserialization) restricts the classes that can be deserialized to only those that are expected and safe, preventing the instantiation of arbitrary or malicious classes (gadget chains) even if the attacker can manipulate the input stream.
During a code review, a developer identifies that the application uses a custom encryption algorithm for storing sensitive data. Which THREE of the following are secure cryptographic practices that should be recommended instead?
Explanation: Using industry-standard, peer-reviewed algorithms like AES-256 (Option A) ensures that the cryptographic strength is mathematically sound and free of the common design flaws found in custom 'security through obscurity' algorithms. Proper key management (Option B) is critical because the security of any cryptographic system relies entirely on keeping the keys secret and managing their lifecycle (generation, storage, rotation, and destruction) securely. Authenticated encryption, such as AES-GCM (Option C), provides both confidentiality and integrity/authenticity, preventing active tampering attacks (like bit-flipping) that standard encryption modes might be vulnerable to. MD5 (Option D) is cryptographically broken and insecure, and static IVs (Option E) destroy the semantic security of block ciphers, making them highly vulnerable to pattern analysis.
+15 more Software Development Security questions available
Practice all Software Development Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Software Development Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Software Development Security questions on the CISSP frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Software Development Security is tested as part of the Certified Information Systems Security Professional CISSP blueprint. Practicing with targeted Software Development Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CISSP practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Software Development Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Software Development Security practice session with instant scoring and detailed explanations.
Start Software Development Security Practice →