CISSP Software Development Security 2

Question 1

Which threat modeling methodology uses attack trees and is primarily attacker-centric in its approach?

Accepted Answer

PASTA

Answer

PASTA (Process for Attack Simulation and Threat Analysis) is attacker-centric and uses attack trees to simulate adversarial objectives.

Question 2

A developer stores API keys directly in source code committed to a public repository. Which secure coding principle was violated?

Accepted Answer

Hardcoded credential avoidance

Answer

Hardcoded credentials in source code violate the principle of externalizing secrets into secure vaults or environment variables.

Question 3

What is the primary purpose of a Web Application Firewall (WAF) in a software security architecture?

Accepted Answer

Filtering malicious HTTP traffic before it reaches the application

Answer

A WAF inspects and filters HTTP/HTTPS requests to block common web attacks like SQLi and XSS before they reach the application.

Question 4

Which software development model integrates security activities such as abuse case development and attack surface analysis into each sprint?

Accepted Answer

Agile SDL

Answer

Agile SDL adapts security practices like abuse case modeling and attack surface analysis to fit iterative sprint cycles.

Question 5

An attacker manipulates a serialized object sent to a Java application causing remote code execution. What vulnerability class does this represent?

Accepted Answer

Insecure deserialization

Answer

Insecure deserialization occurs when an application deserializes attacker-controlled data, potentially enabling RCE or privilege escalation.

CISSP - Certified Information Systems Security Professional Practice Test