Software Development Security — CISSP practice questions

Which is the MOST important control to prevent supply-chain attacks in software dependencies?

1. Let developers install packages directly from public registries unreviewed
2. Rename installed packages internally so their upstream origin is obscured
3. Pin versions, verify signatures, scan components, and mirror internally
4. Disable all automated dependency update tooling across every repository

Answer: C — Pin versions, verify signatures, scan components, and mirror internally

C) Correct: Pinned versions plus signature verification, component scanning, and a curated internal mirror together block typosquatting, dependency confusion, and silent package substitution. A) Unreviewed public installs are precisely how those attacks succeed. B) Renaming is obscurity and changes nothing upstream. D) Freezing updates leaves known vulnerable versions in place.

Which OWASP Top 10 category covers SQL and command injection?

1. Broken access control permitting horizontal privilege abuse
2. Vulnerable and outdated third-party components in the build
3. Cryptographic failures exposing data through weak algorithms
4. Injection, where untrusted input is parsed as code or query
5. Cross-site scripting treated as a wholly separate category

Answer: D — Injection, where untrusted input is parsed as code or query

D is correct: injection covers any flaw where untrusted input crosses into an interpreter and is executed as SQL, shell, LDAP, or XPath. A concerns authorization decisions rather than interpreter confusion. B addresses dependency currency. C addresses protection of data at rest and in transit. E is the closest trap, because cross-site scripting is itself an injection of script into a page and is grouped under injection rather than standing alone. Parameterized queries and output encoding are the primary mitigations.

A team already runs static and dynamic analysis but keeps shipping known-vulnerable third-party packages. Which addition to the pipeline MOST directly closes this gap?

1. Software composition analysis matching dependencies to vulnerability data
2. Increased static analysis coverage across all first-party source repositories
3. Manual peer review of every pull request before it is merged to the main branch
4. Fuzz testing of the application's externally exposed network interfaces

Answer: A — Software composition analysis matching dependencies to vulnerability data

A) Correct — SCA is the control aimed at inherited risk: it identifies open source and third-party components, including transitive dependencies, and flags known vulnerabilities and license issues. B) Static analysis examines code the team wrote and typically has little visibility into packaged dependencies. C) Peer review catches logic and design problems but reviewers cannot know the vulnerability status of every transitive package. D) Fuzzing finds robustness defects at runtime and would only incidentally reveal a known component flaw.

An organization declares a move to DevSecOps. Which change signals that the transition is genuine rather than nominal?

1. The security team has been renamed and now reports into the engineering group
2. A security gate is now a mandatory final approval before every production release
3. Security requirements, automated testing and telemetry are owned in the pipeline
4. Security engineers have been given administrative access to the integration servers

Answer: C — Security requirements, automated testing and telemetry are owned in the pipeline

C) Correct — DevSecOps is the integration of security work into automated delivery with shared ownership and feedback, not a separate stage or a reporting-line change. A) Reorganization alone changes reporting, not practice. B) A mandatory final gate is the pre-DevSecOps model, reintroducing the late bottleneck the approach is meant to dissolve. D) Access for security staff may be useful operationally but is not evidence of integrated practice.

Server-Side Request Forgery (SSRF) is BEST mitigated by:

1. Permitting the application to fetch any arbitrary URL the user supplies
2. Allow-listing permitted destinations and blocking internal and metadata targets
3. Increasing server CPU capacity to absorb the additional attack traffic
4. Disabling outbound request logging from the application server entirely

Answer: B — Allow-listing permitted destinations and blocking internal and metadata targets

B) Correct: Restricting outbound fetches to approved destinations and refusing link-local, loopback, and cloud metadata addresses removes the pivot SSRF depends on. A) Unrestricted fetching is the vulnerability itself. C) SSRF is an access problem, not a capacity problem. D) Removing logs blinds detection without changing the exposure.

An investigation cannot establish who authored a change that introduced a backdoor, because commit metadata can be set freely by any contributor. Which source code management control addresses this?

1. Enforcing a linear history so that merge commits never appear in a branch
2. Requiring that all repositories be mirrored to a second hosting provider
3. Increasing the retention period for repository audit logs to seven years
4. Requiring signed commits verified against enrolled developer keys

Answer: D — Requiring signed commits verified against enrolled developer keys

D) Correct — commit author fields are self-asserted text; signing binds a change to a key held by an enrolled identity, and branch protection can reject unsigned commits, restoring attribution. A) Linear history improves readability of the change record but does not authenticate authorship. B) Mirroring is a resilience measure and copies the same unverified metadata. C) Longer retention preserves records that were never trustworthy to begin with.

Which is best practice for storing user passwords in a web application?

1. Plaintext storage in the application primary user database table
2. Plaintext protected only by the database access control lists
3. Reversible encryption with a key held by the application
4. Salted, key-stretched hashing with bcrypt, scrypt, or argon2id
5. A single unsalted MD5 digest computed for each password

Answer: D — Salted, key-stretched hashing with bcrypt, scrypt, or argon2id

D is correct: a unique random salt defeats precomputed rainbow tables, and a tunable work factor makes offline guessing expensive while remaining acceptable for a single login. A and B leave credentials readable to anyone who obtains the data, and access control lists do not survive a database dump. C is the subtle trap, because encryption is reversible by design, so key compromise exposes every password at once. E is fast and unsalted, which is precisely what a cracking rig exploits.

A business unit has procured a SaaS application without involving security. Which action should the security manager take FIRST?

1. Direct the provider to complete a full penetration test at the firm's expense
2. Determine what data the service holds and review the contract and assurance evidence
3. Block access to the service at the proxy until the business unit reverses the purchase
4. Deploy a cloud access security broker in front of the application before go-live

Answer: B — Determine what data the service holds and review the contract and assurance evidence

B) Correct — assessing acquired services begins with understanding the data and the obligations already agreed; classification and contract review determine what assurance and controls are actually required. A) Demanding a bespoke penetration test of a multi-tenant provider is rarely feasible and skips the analysis that would justify it. C) Blocking a purchased business service before understanding it is disproportionate and damages security's standing as an adviser. D) A CASB may well be part of the answer, but selecting a control before knowing the data and contract terms is backwards.

What is a primary purpose of the OWASP Top 10?

1. A catalog of supported compilers approved for secure build use
2. A glossary of security acronyms used by practitioners today
3. A searchable database of software security patent filings
4. A list of marketing names for commercial scanning products
5. An awareness document ranking critical web application risks

Answer: E — An awareness document ranking critical web application risks

E is correct: it is a periodically updated awareness document that ranks the most critical web application security risks, used to focus developer training and testing effort. A, B, C, and D each describe a reference artifact of a different kind and none reflects risk prioritization. The important nuance is that the Top 10 is an awareness tool rather than an exhaustive standard, so treating it as a complete security requirement set leaves significant categories untested.

A commercial off-the-shelf package will process regulated customer data, and the vendor will not release source code. Which assessment approach is MOST appropriate?

1. Require the vendor to place source code in escrow for the security team to review
2. Accept the vendor's marketing security datasheet as evidence of adequate controls
3. Combine independent assurance reports, contract security terms and hands-on testing
4. Perform static analysis on the delivered binaries to find unsafe function calls

Answer: C — Combine independent assurance reports, contract security terms and hands-on testing

C) Correct — for acquired software the practical assurance set is third-party attestations, binding contract terms covering vulnerability handling and notification, and the organization's own dynamic testing of its deployment. A) Escrow protects against vendor failure and is normally not accessible for security review. B) A vendor datasheet is a marketing claim and carries no independent assurance. D) Binary analysis can add signal but is narrow, often prohibited by license, and cannot substitute for contractual and attestation evidence.

What is API security best practice?

AuthN (OAuth/OIDC/mTLS), AuthZ per endpoint, rate limiting, input validation, schema enforcement, monitoring, version control, OWASP API Top 10 awareness.

What is SQL injection?

Inserting malicious SQL via user input. Allows data theft, modification, OS command execution. Mitigations: parameterized queries, ORM, input validation, least DB privilege.

What is CSRF?

Cross-Site Request Forgery — tricks authenticated user into executing unwanted actions. Mitigations: CSRF tokens, SameSite cookies, double-submit pattern.

What is DevSecOps?

Integrating security into DevOps — security as code, automated SAST/DAST/SCA in pipelines, fast feedback. 'Shift left'.