CISSP Software Development Security 4

Question 1

Which Agile security practice involves writing test cases for known attack scenarios before writing the feature code itself?

Accepted Answer

Abuse case development

Answer

Abuse cases (or misuse cases) define how an attacker could misuse a feature, guiding developers to build defenses proactively.

Question 2

A legacy application uses MD5 to hash passwords. What is the PRIMARY cryptographic concern?

Accepted Answer

MD5 is cryptographically broken and collision-prone

Answer

MD5 is cryptographically broken, susceptible to collision attacks and extremely fast brute-force cracking, making it unsuitable for password hashing.

Question 3

Which memory protection technique randomizes the location of key memory areas (stack, heap, executables) at runtime to impede exploitation?

Accepted Answer

Address Space Layout Randomization (ASLR)

Answer

ASLR randomizes the base addresses of memory regions at each execution, making it harder for attackers to predict jump targets for exploits.

Question 4

In a secure SDLC, at which phase should security requirements be FIRST formally defined?

Accepted Answer

Requirements

Answer

Security requirements must be defined during the Requirements phase so that security controls are architected and built in from the beginning rather than bolted on later.

Question 5

Which secure design principle dictates that a system should deny access by default and only grant access when explicitly permitted?

Accepted Answer

Fail-safe defaults

Answer

Fail-safe defaults means access is denied unless explicitly granted, ensuring that errors or omissions result in a secure (locked) state rather than open access.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Software Development Security 4