How should I use these Software Development Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Software Development Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Software Development Security domain.

CISSP · topic practice

Software Development Security practice questions

Practise Certified Information Systems Security Professional CISSP Software Development Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Software Development Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Software Development Security

Software Development Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Software Development Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Software Development Security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Software Development Security explanation →

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

Trap 1: Implementation

Performing threat modeling during implementation is late; vulnerabilities identified may require costly rework.

Trap 2: Testing

Testing is reactive; threat modeling should be proactive and occur earlier in the SDLC.

Trap 3: Requirements gathering

Threat modeling typically requires a design to analyze, so it is not usually performed during requirements gathering.

Study all Software Development Security common traps →

A
Implementation
Why wrong: Performing threat modeling during implementation is late; vulnerabilities identified may require costly rework.
B
Design
Threat modeling is a design-time activity that helps identify and address security threats before implementation.
C
Testing
Why wrong: Testing is reactive; threat modeling should be proactive and occur earlier in the SDLC.
D
Requirements gathering
Why wrong: Threat modeling typically requires a design to analyze, so it is not usually performed during requirements gathering.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Software Development Security explanation →

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Trap 1: Remove the library from the codebase immediately

This would break functionality and is not feasible without extensive rewriting.

Trap 2: Disable the vulnerable feature in the library

Disabling a feature may not be possible without modifying the library's source code.

Trap 3: Increase logging and monitoring to detect exploitation attempts

This only detects, not prevents, exploitation; it is a detective control, not a preventive one.

Study all Software Development Security common traps →

A
Remove the library from the codebase immediately
Why wrong: This would break functionality and is not feasible without extensive rewriting.
B
Disable the vulnerable feature in the library
Why wrong: Disabling a feature may not be possible without modifying the library's source code.
C
Increase logging and monitoring to detect exploitation attempts
Why wrong: This only detects, not prevents, exploitation; it is a detective control, not a preventive one.
D
Implement a Web Application Firewall (WAF) rule to block exploitation
A WAF can provide virtual patching to mitigate the vulnerability in transit.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Software Development Security explanation →

During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:

String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";

Which of the following is the MOST effective remediation?

Trap 1: Use regular expressions to validate the username and password inputs

Input validation alone is not sufficient; SQL injection can still occur through encoding bypasses.

Trap 2: Encode the input using HTML entity encoding before inclusion in the…

HTML encoding is for XSS, not SQL injection; it does not prevent SQL injection.

Trap 3: Escape single quotes in the input parameters

Escaping is error-prone and may be bypassed; prepared statements are the recommended defense.

Study all Software Development Security common traps →

A
Use regular expressions to validate the username and password inputs
Why wrong: Input validation alone is not sufficient; SQL injection can still occur through encoding bypasses.
B
Encode the input using HTML entity encoding before inclusion in the query
Why wrong: HTML encoding is for XSS, not SQL injection; it does not prevent SQL injection.
C
Escape single quotes in the input parameters
Why wrong: Escaping is error-prone and may be bypassed; prepared statements are the recommended defense.
D
Replace the concatenated query with a prepared statement and bind parameters
Prepared statements ensure user input is treated as data, not executable SQL.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Software Development Security explanation →

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

Trap 1: Security testing is performed only at the end of the project

Agile encourages continuous testing, not just at the end.

Trap 2: Security requirements are finalized upfront

Agile embraces changing requirements; security is integrated throughout, not finalized upfront.

Trap 3: Security documentation is minimized to reduce overhead

Documentation may be reduced, but that is not a security advantage per se.

Study all Software Development Security common traps →

A
Security testing is performed only at the end of the project
Why wrong: Agile encourages continuous testing, not just at the end.
B
Security issues can be addressed incrementally throughout development
Agile's short cycles allow for prompt remediation of security findings.
C
Security requirements are finalized upfront
Why wrong: Agile embraces changing requirements; security is integrated throughout, not finalized upfront.
D
Security documentation is minimized to reduce overhead
Why wrong: Documentation may be reduced, but that is not a security advantage per se.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Software Development Security explanation →

A company is deploying a containerized application using Kubernetes. Which practice BEST ensures the security of the container images?

Trap 1: Restrict containers from running as root

This is a good practice but does not address vulnerabilities in the image itself.

Trap 2: Use the latest version of the base image without scanning

Latest images may still contain vulnerabilities; scanning is essential.

Trap 3: Enable container escape protection

Container escape protection is important but does not prevent image vulnerabilities.

Study all Software Development Security common traps →

A
Scan images for vulnerabilities and use minimal base images
Vulnerability scanning and minimal images reduce risk.
B
Restrict containers from running as root
Why wrong: This is a good practice but does not address vulnerabilities in the image itself.
C
Use the latest version of the base image without scanning
Why wrong: Latest images may still contain vulnerabilities; scanning is essential.
D
Enable container escape protection
Why wrong: Container escape protection is important but does not prevent image vulnerabilities.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Software Development Security explanation →

A development team is implementing a microservices architecture. Which of the following is the BEST approach to secure inter-service communication?

Trap 1: Use JSON Web Tokens (JWT) for each request

JWTs provide authentication but not encryption; the channel may still be unencrypted.

Trap 2: Use API keys transmitted in HTTP headers

API keys are simple but do not provide encryption or mutual authentication.

Trap 3: Place all services behind a single API gateway

An API gateway handles external traffic but does not secure internal service-to-service communication.

Study all Software Development Security common traps →

A
Use JSON Web Tokens (JWT) for each request
Why wrong: JWTs provide authentication but not encryption; the channel may still be unencrypted.
B
Use API keys transmitted in HTTP headers
Why wrong: API keys are simple but do not provide encryption or mutual authentication.
C
Place all services behind a single API gateway
Why wrong: An API gateway handles external traffic but does not secure internal service-to-service communication.
D
Implement mutual TLS (mTLS) between services
mTLS provides strong authentication and encryption for inter-service communication.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Software Development Security explanation →

Which TWO of the following are secure coding practices to prevent buffer overflow vulnerabilities? (Select TWO.)

Trap 1: Use dynamic memory allocation for all buffers

Dynamic allocation does not prevent overflows if bounds are not checked.

Trap 2: Enable Address Space Layout Randomization (ASLR)

ASLR is an OS-level mitigation, not a coding practice.

Trap 3: Deallocate memory after use

Deallocation prevents memory leaks, not buffer overflows.

Study all Software Development Security common traps →

A
Perform bounds checking on array indices and pointers
Bounds checking ensures memory accesses are within allocated space.
B
Use dynamic memory allocation for all buffers
Why wrong: Dynamic allocation does not prevent overflows if bounds are not checked.
C
Enable Address Space Layout Randomization (ASLR)
Why wrong: ASLR is an OS-level mitigation, not a coding practice.
D
Use bounded string functions (e.g., strncpy instead of strcpy)
Bounded functions limit the number of characters copied, preventing overflow.
E
Deallocate memory after use
Why wrong: Deallocation prevents memory leaks, not buffer overflows.

Full breakdown with real-world context →

Question 8hardmulti select

Read the full Software Development Security explanation →

Which THREE of the following are valid techniques to ensure software integrity during the build and deployment process? (Select THREE.)

Trap 1: Implementing role-based access control on the build server

RBAC controls access but does not verify integrity.

Trap 2: Continuous integration automated builds

CI automates builds but does not inherently verify integrity.

Study all Software Development Security common traps →

A
Implementing role-based access control on the build server
Why wrong: RBAC controls access but does not verify integrity.
B
Using cryptographic hashes (e.g., SHA-256) to verify files
Hashes detect unauthorized changes.
C
Continuous integration automated builds
Why wrong: CI automates builds but does not inherently verify integrity.
D
Performing checksum verification after deployment
Checksums ensure the deployed artifact matches the source.
E
Code signing with a trusted certificate
Digital signatures provide authenticity and integrity.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Software Development Security explanation →

A financial services company uses a custom web application for online banking. The application is developed in-house using Java and deployed on Apache Tomcat servers. Recently, the security team discovered that the application is vulnerable to a critical remote code execution (RCE) vulnerability due to insecure deserialization of untrusted data. The vulnerability exists in a module that processes session objects. The development team has been assigned to fix this issue. They propose the following options:

A. Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes. B. Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default. C. Encrypt all serialized objects using AES-256 before sending them to the client. D. Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

The application must maintain high availability and minimal latency. Which option provides the MOST effective and sustainable remediation?

Trap 1: Use a Web Application Firewall (WAF) to block requests containing…

WAF rules are reactive and can be bypassed by novel or obfuscated payloads; they do not fix the underlying vulnerability.

Trap 2: Implement a custom deserialization filter using ObjectInputFilter…

While filtering can help, it is error-prone and may not cover all classes; also, it does not address the fundamental risk of Java deserialization.

Trap 3: Encrypt all serialized objects using AES-256 before sending them to…

Encryption protects data in transit but does not prevent deserialization attacks because the decrypted data is still deserialized.

Study all Software Development Security common traps →

A
Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.
This eliminates the insecure deserialization vector by using a safer serialization format and disabling dangerous features.
B
Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.
Why wrong: WAF rules are reactive and can be bypassed by novel or obfuscated payloads; they do not fix the underlying vulnerability.
C
Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.
Why wrong: While filtering can help, it is error-prone and may not cover all classes; also, it does not address the fundamental risk of Java deserialization.
D
Encrypt all serialized objects using AES-256 before sending them to the client.
Why wrong: Encryption protects data in transit but does not prevent deserialization attacks because the decrypted data is still deserialized.

Full breakdown with real-world context →

Question 10mediumdrag order

Read the full Software Development Security explanation →

Drag and drop the steps for conducting a business impact analysis (BIA) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediumdrag order

Read the full Software Development Security explanation →

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Read the full Software Development Security explanation →

Match each security model to its primary characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

No read up, no write down

No read down, no write up

Well-formed transactions and separation of duties

Prevents conflict of interest among clients

Rules for granting and taking permissions

Question 13mediummatching

Read the full Software Development Security explanation →

Match each OSI layer to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Frames and MAC addressing

Routing and logical addressing

End-to-end reliability and segmentation

User interface and application services

Question 14easymultiple choice

Read the full Software Development Security explanation →

A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?

Trap 1: Only using open-source vulnerability scanners

Open-source scanners are useful but insufficient for custom code.

Trap 2: Dynamic Application Security Testing (DAST) in the production stage

DAST should be performed later, not in the build stage.

Trap 3: Manual code review after each sprint

Manual reviews are too time-intensive for continuous integration.

Study all Software Development Security common traps →

A
Only using open-source vulnerability scanners
Why wrong: Open-source scanners are useful but insufficient for custom code.
B
Dynamic Application Security Testing (DAST) in the production stage
Why wrong: DAST should be performed later, not in the build stage.
C
Manual code review after each sprint
Why wrong: Manual reviews are too time-intensive for continuous integration.
D
Static Application Security Testing (SAST) in the build stage
SAST scans source code early, fitting CI/CD build stages.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Software Development Security explanation →

An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?

Trap 1: Perform a single security review at the end of the release cycle

This is a waterfall approach; agile requires iterative security.

Trap 2: Conduct security testing only during the integration phase

Security should be continuous throughout the sprint.

Trap 3: Skip threat modeling and rely solely on automated scanning

Threat modeling identifies design flaws that scanners miss.

Study all Software Development Security common traps →

A
Perform a single security review at the end of the release cycle
Why wrong: This is a waterfall approach; agile requires iterative security.
B
Conduct security testing only during the integration phase
Why wrong: Security should be continuous throughout the sprint.
C
Skip threat modeling and rely solely on automated scanning
Why wrong: Threat modeling identifies design flaws that scanners miss.
D
Include security requirements in user stories and conduct threat modeling each iteration
This embeds security into agile practices.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full Software Development Security explanation →

In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?

Trap 1: Segment services into separate VLANs without encryption

Network segmentation does not protect against internal threats.

Trap 2: Use TLS only for all communication

TLS alone lacks peer authentication.

Trap 3: Rely on API keys in the request headers

API keys can be leaked and do not provide per-request authentication.

Study all Software Development Security common traps →

A
Segment services into separate VLANs without encryption
Why wrong: Network segmentation does not protect against internal threats.
B
Use TLS only for all communication
Why wrong: TLS alone lacks peer authentication.
C
Implement mutual TLS (mTLS) and identity-based access policies
mTLS provides strong authentication and encryption per request.
D
Rely on API keys in the request headers
Why wrong: API keys can be leaked and do not provide per-request authentication.

Full breakdown with real-world context →

Question 17mediummulti select

Read the full Software Development Security explanation →

Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)

Trap 1: Encode output to the browser

This prevents XSS, not injection attacks.

Trap 2: Encrypt sensitive input data

Encryption does not mitigate injection vulnerabilities.

Trap 3: Use custom error messages that detail the failure

Detailed errors can aid attackers.

Study all Software Development Security common traps →

A
Encode output to the browser
Why wrong: This prevents XSS, not injection attacks.
B
Encrypt sensitive input data
Why wrong: Encryption does not mitigate injection vulnerabilities.
C
Use custom error messages that detail the failure
Why wrong: Detailed errors can aid attackers.
D
Use parameterized queries or prepared statements
Separates SQL logic from data, preventing injection.
E
Validate and sanitize all user input
Prevents malformed input from entering queries.

Full breakdown with real-world context →

Question 18hardmulti select

Read the full Software Development Security explanation →

Which THREE of the following are essential components of a software supply chain security program? (Select exactly three.)

Trap 1: Running penetration tests on the production environment

Pen tests are valuable but not a supply chain-specific component.

Trap 2: Conducting static analysis on all in-house code

This is important but applies to internal development, not supply chain.

Study all Software Development Security common traps →

A
Using signed and verified software artifacts
Signing ensures integrity and authenticity of artifacts.
B
Maintaining a software bill of materials (SBOM) for all dependencies
SBOMs help track and manage third-party components.
C
Running penetration tests on the production environment
Why wrong: Pen tests are valuable but not a supply chain-specific component.
D
Conducting static analysis on all in-house code
Why wrong: This is important but applies to internal development, not supply chain.
E
Performing security assessments on third-party vendors
Ensures vendors meet security requirements.

Full breakdown with real-world context →

Question 19easymulti select

Read the full Software Development Security explanation →

Which TWO of the following are fundamental phases of a secure software development lifecycle (SSDLC) where security should be integrated? (Select exactly two.)

Trap 1: Software retirement

Retirement is the final phase, not a primary integration point.

Trap 2: User acceptance testing

UAT is functional, not security-focused.

Trap 3: Production operations

Operations are after deployment; SSDLC includes earlier phases.

Study all Software Development Security common traps →

A
Testing and validation
Security testing should occur before release.
B
Software retirement
Why wrong: Retirement is the final phase, not a primary integration point.
C
User acceptance testing
Why wrong: UAT is functional, not security-focused.
D
Production operations
Why wrong: Operations are after deployment; SSDLC includes earlier phases.
E
Requirements gathering
Security requirements should be defined at the start.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Software Development Security explanation →

Refer to the exhibit. Which security weakness should be addressed first in this Dockerfile?

Exhibit

FROM ubuntu:latest
RUN apt-get update && apt-get install -y python
COPY . /app
WORKDIR /app
CMD ["python", "app.py"]

Trap 1: Installing Python without version pinning

Version pinning is recommended but less urgent than root access.

Trap 2: No multistage build is used

Multistage builds reduce image size but are not a direct security issue.

Trap 3: The use of 'latest' tag for the base image

Using 'latest' can cause inconsistencies but is not the most critical weakness.

Study all Software Development Security common traps →

A
Installing Python without version pinning
Why wrong: Version pinning is recommended but less urgent than root access.
B
No multistage build is used
Why wrong: Multistage builds reduce image size but are not a direct security issue.
C
The container runs as root by default
Running as root greatly increases the attack surface; a non-root user should be created.
D
The use of 'latest' tag for the base image
Why wrong: Using 'latest' can cause inconsistencies but is not the most critical weakness.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Software Development Security sessions

Start a Software Development Security only practice session

Every question in these sessions is drawn from the Software Development Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Software Development Security questions →Mixed CISSP session

Frequently asked questions

What does the CISSP exam test about Software Development Security?: Software Development Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Software Development Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Software Development Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CISSP topics?: Use the topic links above to move to related areas, or go back to the CISSP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CISSP exam covers. They are not copied from any real exam or dump site.

Software Development Security only

10 questions 20 questions 30 questions 50 questions

Mixed CISSP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CISSP questions Software Development Security domain overview CISSP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Software Development Security practice questions

What to know about Software Development Security

Common Software Development Security exam traps

Software Development Security questions

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

A company is deploying a containerized application using Kubernetes. Which practice BEST ensures the security of the container images?

A development team is implementing a microservices architecture. Which of the following is the BEST approach to secure inter-service communication?

Which TWO of the following are secure coding practices to prevent buffer overflow vulnerabilities? (Select TWO.)

Which THREE of the following are valid techniques to ensure software integrity during the build and deployment process? (Select THREE.)

Drag and drop the steps for conducting a business impact analysis (BIA) in the correct order.

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Match each security model to its primary characteristic.

Match each OSI layer to its function.

A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?

An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?

In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?

Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)

Which THREE of the following are essential components of a software supply chain security program? (Select exactly three.)

Which TWO of the following are fundamental phases of a secure software development lifecycle (SSDLC) where security should be integrated? (Select exactly two.)

Refer to the exhibit. Which security weakness should be addressed first in this Dockerfile?

Exhibit

Track your progress over time

Start a Software Development Security only practice session

Related CISSP topic practice pages