CISSP Software Development Security 4 — Questions and Answers
Question 1: Which Agile security practice involves writing test cases for known attack scenarios before writing the feature code itself?
- Red team testing
- Abuse case development (Correct answer)
- Penetration testing
- Regression testing
Correct answer: Abuse case development
Abuse cases (or misuse cases) define how an attacker could misuse a feature, guiding developers to build defenses proactively.
Question 2: A legacy application uses MD5 to hash passwords. What is the PRIMARY cryptographic concern?
- MD5 is too slow for authentication systems
- MD5 lacks a salt parameter
- MD5 is cryptographically broken and collision-prone (Correct answer)
- MD5 produces hashes that are too short for storage
Correct answer: MD5 is cryptographically broken and collision-prone
MD5 is cryptographically broken, susceptible to collision attacks and extremely fast brute-force cracking, making it unsuitable for password hashing.
Question 3: Which memory protection technique randomizes the location of key memory areas (stack, heap, executables) at runtime to impede exploitation?
- Data Execution Prevention (DEP)
- Address Space Layout Randomization (ASLR) (Correct answer)
- Stack canaries
- Control Flow Integrity (CFI)
Correct answer: Address Space Layout Randomization (ASLR)
ASLR randomizes the base addresses of memory regions at each execution, making it harder for attackers to predict jump targets for exploits.
Question 4: In a secure SDLC, at which phase should security requirements be FIRST formally defined?
- Testing
- Deployment
- Requirements (Correct answer)
- Maintenance
Correct answer: Requirements
Security requirements must be defined during the Requirements phase so that security controls are architected and built in from the beginning rather than bolted on later.
Question 5: Which secure design principle dictates that a system should deny access by default and only grant access when explicitly permitted?
- Fail-safe defaults (Correct answer)
- Open design
- Economy of mechanism
- Separation of privilege
Correct answer: Fail-safe defaults
Fail-safe defaults means access is denied unless explicitly granted, ensuring that errors or omissions result in a secure (locked) state rather than open access.
Question 6: What is a primary security risk of using eval() functions in interpreted languages such as JavaScript or Python?
- Increased memory consumption
- Arbitrary code execution if user input is evaluated (Correct answer)
- Slower execution compared to compiled code
- Inability to handle Unicode characters
Correct answer: Arbitrary code execution if user input is evaluated
eval() executes its string argument as code; if user-controlled input reaches eval(), an attacker can inject and execute arbitrary code.
Question 7: Which type of testing sends random, malformed, or unexpected inputs to an application interface to discover crashes and vulnerabilities?
- Unit testing
- Fuzz testing (Correct answer)
- Regression testing
- User acceptance testing
Correct answer: Fuzz testing
Fuzz testing (fuzzing) automatically generates large volumes of invalid or random inputs to trigger unexpected behavior, crashes, or security flaws.
CISSP Software Development Security 4
Which Agile security practice involves writing test cases for known attack scenarios before writing the feature code itself?