CISSP Software Development Security 2 — Questions and Answers
Question 1: Which threat modeling methodology uses attack trees and is primarily attacker-centric in its approach?
- STRIDE
- PASTA (Correct answer)
- VAST
- OCTAVE
Correct answer: PASTA
PASTA (Process for Attack Simulation and Threat Analysis) is attacker-centric and uses attack trees to simulate adversarial objectives.
Question 2: A developer stores API keys directly in source code committed to a public repository. Which secure coding principle was violated?
- Separation of duties
- Principle of least privilege
- Hardcoded credential avoidance (Correct answer)
- Defense in depth
Correct answer: Hardcoded credential avoidance
Hardcoded credentials in source code violate the principle of externalizing secrets into secure vaults or environment variables.
Question 3: What is the primary purpose of a Web Application Firewall (WAF) in a software security architecture?
- Encrypting data at rest
- Filtering malicious HTTP traffic before it reaches the application (Correct answer)
- Managing user authentication tokens
- Scanning source code for vulnerabilities
Correct answer: Filtering malicious HTTP traffic before it reaches the application
A WAF inspects and filters HTTP/HTTPS requests to block common web attacks like SQLi and XSS before they reach the application.
Question 4: Which software development model integrates security activities such as abuse case development and attack surface analysis into each sprint?
- Waterfall
- Microsoft SDL
- Agile SDL (Correct answer)
- RAD
Correct answer: Agile SDL
Agile SDL adapts security practices like abuse case modeling and attack surface analysis to fit iterative sprint cycles.
Question 5: An attacker manipulates a serialized object sent to a Java application causing remote code execution. What vulnerability class does this represent?
- XML External Entity (XXE)
- Insecure deserialization (Correct answer)
- Server-Side Request Forgery
- Broken access control
Correct answer: Insecure deserialization
Insecure deserialization occurs when an application deserializes attacker-controlled data, potentially enabling RCE or privilege escalation.
Question 6: Which metric in the CVSS v3 scoring system reflects whether a successful attack requires interaction from a user other than the attacker?
- Attack Vector
- Privileges Required
- User Interaction (Correct answer)
- Scope
Correct answer: User Interaction
The User Interaction metric indicates whether exploitation requires a victim to perform an action, such as clicking a malicious link.
Question 7: What is the purpose of canary values placed on the stack by modern compilers?
- Encrypt function return addresses
- Detect stack buffer overflow before function returns (Correct answer)
- Log system call activity for auditing
- Randomize heap memory allocation
Correct answer: Detect stack buffer overflow before function returns
Stack canaries are secret values placed before the return address; if overwritten by a buffer overflow they trigger a process termination.
CISSP Software Development Security 2
Which threat modeling methodology uses attack trees and is primarily attacker-centric in its approach?