CISSP Software Development Security 5 — Questions and Answers
Question 1: Which technique involves inserting instrumentation into a running application to detect attacks in real time without modifying the source code?
- Static Application Security Testing (SAST)
- Runtime Application Self-Protection (RASP) (Correct answer)
- Software Composition Analysis (SCA)
- Interactive Application Security Testing (IAST)
Correct answer: Runtime Application Self-Protection (RASP)
RASP embeds security controls directly into an application's runtime environment, detecting and blocking attacks as the application executes.
Question 2: A developer uses a third-party open-source component that contains a known critical vulnerability. Which process is MOST effective at systematically identifying this risk across an enterprise?
- Manual code review of all dependencies
- Software Composition Analysis (SCA) (Correct answer)
- Penetration testing the production application
- Code signing all third-party libraries
Correct answer: Software Composition Analysis (SCA)
SCA tools automatically inventory open-source dependencies and match them against vulnerability databases like NVD to flag known-vulnerable components.
Question 3: Which XML-specific vulnerability allows an attacker to read arbitrary files on the server by referencing external entities in a crafted XML document?
- XPATH Injection
- XML External Entity (XXE) Injection (Correct answer)
- SOAP Action Spoofing
- JSON Hijacking
Correct answer: XML External Entity (XXE) Injection
XXE injection exploits misconfigured XML parsers that process external entity references, enabling attackers to read local files or perform SSRF attacks.
Question 4: In the context of secure software development, what is the definition of 'code signing'?
- Encrypting source code before committing to a repository
- Applying a digital signature to software so recipients can verify its integrity and authenticity (Correct answer)
- Marking code modules as reviewed in a bug tracker
- Adding a copyright watermark to compiled binaries
Correct answer: Applying a digital signature to software so recipients can verify its integrity and authenticity
Code signing uses a developer's private key to sign software, allowing users to verify via the corresponding public key that the code is untampered and from a trusted author.
Question 5: Which access control model is MOST appropriate for applications that must enforce data confidentiality based on government-classified labels like Top Secret and Secret?
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC enforces access based on sensitivity labels assigned by the system, preventing users from sharing data above their clearance level regardless of their discretion.
Question 6: A CI/CD pipeline automatically deploys code to production after tests pass. Which security control BEST reduces the risk of malicious code being deployed without human review?
- Requiring multi-factor authentication for developers
- Implementing mandatory code peer review and approval gates before merging (Correct answer)
- Encrypting the pipeline configuration files
- Logging all pipeline execution events to a SIEM
Correct answer: Implementing mandatory code peer review and approval gates before merging
Mandatory peer review approval gates ensure at least one additional human verifies changes before they can be merged and deployed to production.
Question 7: Which software security concept ensures that a module performs only the functions necessary for its purpose and does not have access to unneeded resources?
- Defense in depth
- Principle of least privilege (Correct answer)
- Security by obscurity
- Fail-safe defaults
Correct answer: Principle of least privilege
The principle of least privilege limits software modules to only the permissions and resources they need to perform their defined function, reducing the blast radius of a compromise.
CISSP Software Development Security 5
Which technique involves inserting instrumentation into a running application to detect attacks in real time without modifying the source code?