CISSP Software Development Security 3

Question 1

Which type of code review technique has reviewers examine source code without executing it, looking for logic flaws and vulnerabilities?

Accepted Answer

Static analysis

Answer

Static analysis (or static code review) inspects source or binary code without running it, identifying vulnerabilities through pattern and logic analysis.

Question 2

A CISSP candidate evaluates a third-party library with an open-source license. What is the MOST critical security concern for software supply chain integrity?

Accepted Answer

Verifying the library's cryptographic hash against the official repository

Answer

Verifying cryptographic hashes ensures the downloaded library has not been tampered with during distribution (supply chain attack prevention).

Question 3

Which software assurance concept involves identifying the minimum set of interfaces and entry points exposed by an application to reduce its attack exposure?

Accepted Answer

Attack surface reduction

Answer

Attack surface reduction minimizes the number of exposed code paths, APIs, and interfaces that could be exploited by attackers.

Question 4

In OAuth 2.0, which grant type is considered MOST risky because it exposes access tokens in the browser URL fragment?

Accepted Answer

Implicit

Answer

The implicit grant type returns tokens directly in the URL fragment, making them visible in browser history and logs, and is now deprecated in OAuth 2.1.

Question 5

What is the role of a Security Champions program within a software development organization?

Accepted Answer

Embedding security-aware developers within each product team to promote secure coding

Answer

Security Champions are developers embedded in product teams who promote security awareness and act as liaisons to the central security team.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Software Development Security 3