CISSP Software Development Security 5

Question 1

Which technique involves inserting instrumentation into a running application to detect attacks in real time without modifying the source code?

Accepted Answer

Runtime Application Self-Protection (RASP)

Answer

RASP embeds security controls directly into an application's runtime environment, detecting and blocking attacks as the application executes.

Question 2

A developer uses a third-party open-source component that contains a known critical vulnerability. Which process is MOST effective at systematically identifying this risk across an enterprise?

Accepted Answer

Software Composition Analysis (SCA)

Answer

SCA tools automatically inventory open-source dependencies and match them against vulnerability databases like NVD to flag known-vulnerable components.

Question 3

Which XML-specific vulnerability allows an attacker to read arbitrary files on the server by referencing external entities in a crafted XML document?

Accepted Answer

XML External Entity (XXE) Injection

Answer

XXE injection exploits misconfigured XML parsers that process external entity references, enabling attackers to read local files or perform SSRF attacks.

Question 4

In the context of secure software development, what is the definition of 'code signing'?

Accepted Answer

Applying a digital signature to software so recipients can verify its integrity and authenticity

Answer

Code signing uses a developer's private key to sign software, allowing users to verify via the corresponding public key that the code is untampered and from a trusted author.

Question 5

Which access control model is MOST appropriate for applications that must enforce data confidentiality based on government-classified labels like Top Secret and Secret?

Accepted Answer

Mandatory Access Control (MAC)

Answer

MAC enforces access based on sensitivity labels assigned by the system, preventing users from sharing data above their clearance level regardless of their discretion.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Software Development Security 5