CISSP Software Development Security 3 — Questions and Answers
Question 1: Which type of code review technique has reviewers examine source code without executing it, looking for logic flaws and vulnerabilities?
- Dynamic analysis
- Fuzz testing
- Static analysis (Correct answer)
- Penetration testing
Correct answer: Static analysis
Static analysis (or static code review) inspects source or binary code without running it, identifying vulnerabilities through pattern and logic analysis.
Question 2: A CISSP candidate evaluates a third-party library with an open-source license. What is the MOST critical security concern for software supply chain integrity?
- License compatibility with commercial software
- Verifying the library's cryptographic hash against the official repository (Correct answer)
- The library's version number
- Whether the library uses object-oriented design
Correct answer: Verifying the library's cryptographic hash against the official repository
Verifying cryptographic hashes ensures the downloaded library has not been tampered with during distribution (supply chain attack prevention).
Question 3: Which software assurance concept involves identifying the minimum set of interfaces and entry points exposed by an application to reduce its attack exposure?
- Threat modeling
- Attack surface reduction (Correct answer)
- Code signing
- Security regression testing
Correct answer: Attack surface reduction
Attack surface reduction minimizes the number of exposed code paths, APIs, and interfaces that could be exploited by attackers.
Question 4: In OAuth 2.0, which grant type is considered MOST risky because it exposes access tokens in the browser URL fragment?
- Authorization code
- Client credentials
- Implicit (Correct answer)
- Device authorization
Correct answer: Implicit
The implicit grant type returns tokens directly in the URL fragment, making them visible in browser history and logs, and is now deprecated in OAuth 2.1.
Question 5: What is the role of a Security Champions program within a software development organization?
- Outsourcing all security testing to a dedicated team
- Embedding security-aware developers within each product team to promote secure coding (Correct answer)
- Enforcing regulatory compliance audits on each sprint
- Replacing the security operations center functions
Correct answer: Embedding security-aware developers within each product team to promote secure coding
Security Champions are developers embedded in product teams who promote security awareness and act as liaisons to the central security team.
Question 6: Which database security control prevents an attacker who obtains a dump of hashed passwords from immediately cracking common passwords using precomputed rainbow tables?
- Encryption at rest
- Password salting (Correct answer)
- Role-based access control
- Connection pooling
Correct answer: Password salting
Salting adds a unique random value to each password before hashing, making precomputed rainbow table attacks ineffective.
Question 7: An application allows users to upload files and immediately executes them on the server. Which vulnerability does this PRIMARILY represent?
- Path traversal
- Remote code execution via unrestricted file upload (Correct answer)
- Cross-site scripting
- Broken authentication
Correct answer: Remote code execution via unrestricted file upload
Unrestricted file upload without type validation and execution prevention allows attackers to upload and execute malicious scripts or binaries.
CISSP Software Development Security 3
Which type of code review technique has reviewers examine source code without executing it, looking for logic flaws and vulnerabilities?