CISSP Software Development Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Encrypting data at rest only

  Why it's wrong here

  While encrypting data at rest is a critical security measure for protecting information stored on physical media, relying on it exclusively fails to implement a comprehensive defense-in-depth strategy. This approach leaves data vulnerable during transmission across networks (data in transit) and when actively being processed (data in use), which are common points of compromise in e-commerce transactions. A robust security posture requires encryption across all data states, complemented by other controls like access management and network segmentation.

• ✓

  Implementing both a web application firewall (WAF) and input validation

  Why this is correct

  This option correctly demonstrates defense in depth by combining two distinct and complementary security controls. A Web Application Firewall (WAF) provides an external, perimeter-like defense, filtering malicious requests before they reach the application server, while input validation acts as an internal, application-level control, ensuring that only safe and properly formatted data is processed. This layered approach significantly reduces the attack surface and effectively mitigates a broader spectrum of web-based threats, such as SQL injection and cross-site scripting, by providing multiple points of enforcement.

• ✗

  Using a single firewall at the network perimeter

  Why it's wrong here

  Using only a single firewall at the network perimeter, while a foundational security component, represents a single layer of defense and does not embody the principles of defense in depth. This creates a single point of failure; if an attacker manages to bypass this sole barrier, they gain largely unimpeded access to internal network resources. A true defense-in-depth strategy would incorporate additional internal firewalls, host-based firewalls, network segmentation, and other controls to create multiple chokepoints and slow down an adversary's lateral movement.

• ✗

  Requiring strong passwords for all users

  Why it's wrong here

  Requiring strong passwords for all users is an essential security practice for identity and access management, but it constitutes only one control within a much broader security framework. This single control does not provide the multi-layered protection inherent in a defense-in-depth strategy. A comprehensive approach would augment strong passwords with additional controls such as multi-factor authentication (MFA), account lockout policies, robust session management, and intrusion detection systems to protect against various attack vectors beyond simple credential guessing.

Go deeper

Related to this question