CISSP Domain 8 – Software Development Security Practice Test

These questions are part of the practice quiz. Start practicing

• What does threat intelligence provide to developers?
• Which of the following is a key characteristic of Defensive Programming?
• How does vulnerability assessment contribute to software security?
• What is the primary goal of Software Development Security in CISSP?
• Which database model organizes records in tables that are interrelated to implement necessary business logic?
• What describes the data structure that encapsulates data and methods?
• Which of the following is an example of a secure coding guideline?
• What is the goal of Static Application Security Testing (SAST)?
• What characteristic is shared by both viruses and worms?
• What methodology focuses on the authorized movement and execution of data within a system?
• Which term refers to a data warehouse that integrates multiple streams of unstructured data?
• What is Metadata?
• What purpose do anti-malware scanners serve in software security?
• Which of the following best describes a key aspect of Knowledge Management?
• What type of malware often inserts backdoors into legitimate programs?
• Which type of attack is characterized by using existing system capabilities to pursue an attacker's agenda without malware?
• What does the term "acceptance" refer to in the context of software development?
• What is the primary purpose of security testing in software development?
• What is the purpose of Defensive Programming in software development?
• Which term describes the creation of a new instance of data while maintaining the same identifier?
• Why is certification important in system security?
• What is protocol fuzzing used for?
• What defines a zero-day vulnerability?
• Which phase of the software development lifecycle follows the acceptance testing phase?
• What model of software development features iterative cycles rather than a linear process?
• What is a significant risk when using third-party libraries in software security?
• What is the main focus of the DevOps methodology?
• What security risk may be associated with open-source software?
• What software architectural style is used for synchronizing activities between applications over a network?
• What term describes software that monitors and gathers data, sometimes used to refer to adware and spyware?
• Which characteristic defines Agile methodology in software development?
• Which approach merges traditional phased reviews with agile methodologies to enhance security in software development?
• How effectively a programming language prevents erroneous operations on different data types is known as?
• What is the importance of comprehensive documentation in software security?
• What are application security controls?
• Which model emphasizes risk management and incorporates user feedback throughout the development cycle?
• Which of the following best describes Agile development?
• What type of attacks seeks to compromise system integrity by manipulating inputs?
• Which action is part of the configuration control process?
• What is a hidden mechanism that bypasses access control measures, allowing unauthorized access?
• What is the primary purpose of accreditation in the context of information systems?
• What concept restricts one software unit from accessing the private data of another?
• What does Runtime Application Security Protection (RASP) primarily do?
• What is meant by a secure software development framework?
• What analysis technique extracts deeper meanings from various types of data?
• Which term refers to a set of data encapsulated with methods to manipulate that data?
• Which of the following models represents relationships between different types of data elements?
• What does CI/CD stand for in secure software development?
• What does regression testing focus on within a software application?
• Which term refers to the set of software that performs specific functions with defined input and output?
• What is the goal of using regression testing in security?
• What is an important use of threat modeling?
• Which feature of a programming language helps prevent data type mismatch errors?
• What term describes the activities focused on maintaining the integrity of IT products and systems throughout their lifecycle?
• What is the primary benefit of secure encryption in software?
• What is the benefit of code reuse in software development?
• What is the purpose of secure coding practices?
• What term describes a collection of data sources for enhanced analysis and trending?
• What is the goal of Dynamic Application Security Testing (DAST)?
• What does code protection or logic hiding prevent?
• What are software libraries primarily used for?
• What is the primary aim of Software Capability Maturity Modeling (SW-CMM)?
• What are commercial off-the-shelf (COTS) applications designed for?
• What type of attack exploits the delay between a security check and actual asset use?
• How does physical security relate to software security?
• What role do Application Programming Interfaces (APIs) serve in modern applications?
• What is the importance of threat agents in the context of software development?
• Which development approach involves creating an initial simplified version of an application for review and feedback?
• Which definition best describes Malware?
• What is the process of modifying software to improve its clarity, efficiency, or maintainability called?
• What best describes the relationship between CI/CD and security?
• How does version control enhance security in software development?
• Which statement best describes a botnet?
• What process protects the information system from improper modifications?
• What are the main phases of the Software Development Life Cycle (SDLC)?
• What do secure coding guidelines aim to achieve?
• What is one of the major factors influencing environmental security in software development?
• What is defined as a file or set of files sent by one system to client systems, which executes software or controls applications?
• What role does training play in a security incident response plan?
• Which programming technique allows a function to be defined in multiple ways?
• What is the significance of the ACID properties in database systems?
• In the context of software development, what does "data hiding" refer to?
• How can an organization demonstrate its commitment to secure software development?
• What aspect of view-based access controls allows for user-specific data visibility?
• What does "arbitrary code" refer to in terms of security?
• What is Executable Code commonly referred to in programming?
• What is the role of threat agents in software security?
• What approach reduces the need for manual coordination within the software development process?
• What is a security incident response plan (IRP)?
• What does a security assessment evaluate?
• In which database model are data elements arranged in arbitrary linked forms like lists or clusters?
• What does the term "aggregation" refer to in software security?
• What is the objective of a Security Development Lifecycle (SDL)?
• Which type of malicious software can self-replicate without altering other files or programs?
• What role do automated tools play in software security?
• Which application security testing methodology occurs during execution of the code?
• Which type of testing simulates an attack on the software to assess security?
• What is the function of a sandbox in software development?
• Which model emphasizes a sequential approach to software development?
• Why is remediation critical in software development security?
• What is the focus of nonfunctional requirements in system development?
• Which type of attack involves encrypting information assets and demanding payment for the decryption key?
• What kind of software has its source code available for public use, modification, and inspection?
• What term describes the collection of all hardware, software, and firmware responsible for system security?
• What is an attempt to circumvent database application controls called?
• What is a significant advantage of having a well-defined Trusted Computing Base (TCB)?
• What does the 'allowed list' refer to in security terms?
• How do scanners (anti-malware) function?
• Which of the following is NOT a common type of security testing?
• Which of the following best describes a sandbox?
• What type of vulnerability is a buffer overflow?
• Which term refers to characteristics such as safety and security in systems-level behavior?
• What does the spiral model of software development emphasize?
• What is a primary objective of a Database Management System (DBMS)?
• In what way can markup languages extend into programming languages?
• What does the principle of least privilege in software design ensure?
• What is the definition of Advanced Persistent Threats (APTs)?
• Which of the following is an outcome of a well-defined security incident response plan?
• Which process improves the traditional waterfall model by incorporating PDCA sub-stages throughout the SDLC?
• What role do firewalls play in software development security?
• How can user authentication strengthen software security?
• What process involves identifying all data elements needed for a system's operational use?
• Which coding standard is widely adopted to promote security?
• What is achieved through the implementation of secure coding guidelines?
• What is a characteristic of Data Lakes compared to traditional data warehouses?
• What does data classification involve?
• Why is documentation important in software development security?
• What does the software development lifecycle (SDLC) encompass?
• What is a potential outcome when memory or resources are improperly managed between processes?
• What is a key characteristic of Agile development methodologies?
• Which of the following describes a Database Management System (DBMS)?
• What is the primary function of Application Programming Interfaces (APIs)?
• Why are Advanced Persistent Threats particularly concerning for organizations?
• What is the importance of environmental security in software development?
• What is the main function of an access control list (ACL) in applications?
• Which of the following best describes the purpose of code protection or logic hiding?
• What is the goal of establishing security policies within a software development lifecycle?
• What is the primary function of code obfuscation?
• What defines the organization, structure, and architecture used by a DBMS to meet business needs?
• Which programming method allows software external to an object to request methods performed within that object?
• What is the main purpose of software security compliance?
• What type of testing seeks to find vulnerabilities by sending incorrect input to a system?
• Who are citizen programmers?
• Which of the following techniques can be used to access data not normally allowed by a system?
• What is the main objective of a Software Security Assurance program?
• How do security policies contribute to software development?
• Which approach focuses on reducing time taken to include customer feedback in development cycles?
• What type of attack involves the use of malformed SQL queries to bypass security controls?
• What can incomplete or misunderstood requirements lead to?
• How does a Malformed Input Attack typically impact software functionality?
• Which of the following is a key component of software compliance?
• Which term describes a software program that can replicate and spread itself without user consent?
• Why is end-user education considered essential in software security?
• What term is used to describe security designs utilizing object-oriented programming characteristics?
• What technique is used to identify security requirements?
• What is the term for a communications pathway that can violate security policies by transferring information?
• Which programming paradigm emphasizes a logical sequence of steps to execute a function?
• What does input validation help prevent?
• In software development, what does the ACID test ensure?
• Which phase of the SDLC is critical for identifying design flaws?
• What is known as an exploit of a vulnerability that remains undetected until identified by system developers?
• How can organizations ensure secure software development practices?
• What is one goal of data classification in software security?
• What does encapsulation in software development emphasize?
• Why is patch management important in software security?
• What is compliance in the context of software development security?
• What is a major objective of implementing secure coding practices?
• What are blocked and allowed lists used for in software security?
• What does "Level of Abstraction" refer to in software documentation?
• What is a key responsibility of a security architect in software development?
• What is the primary purpose of end-user education in software security?
• What are the consequences of insecure software development?
• What is a common risk during the requirements gathering phase?
• What is the term for the method of identifying valid and useful patterns in data using mathematical and statistical techniques?
• What is the name of tools that analyze source code for various errors but do not execute the code?
• What does direct user input allow attackers to exploit without proper validation?
• What is the primary purpose of Configuration Management (CM)?
• What role does secure configuration management play in software security?
• What do we call the program statements written in a human-readable form using a formal programming language's rules?
• In programming, what can strongly typed languages prevent?
• What does security hardening refer to?
• What kind of attack occurs when software fails to properly handle unexpected input data?
• What is the characteristic feature of a worm compared to a virus?
• Why is user validation critical in software security?
• What type of requirements identify broad characteristics of a system, often deemed nonfunctional by analysts?
• What is the main benefit of threat modeling in software development?
• Which term describes the malicious software designed specifically to exploit unreported vulnerabilities?
• What are Logic Bombs in the context of computer security?
• What issue arises from memory or object reuse in computer systems?
• In terms of security, what is a significant risk associated with citizen programming?
• What type of attack is classified as a zero-day exploit?
• How does software escrow enhance software development security?
• What type of access control allows sensitive data to be hidden from unauthorized users by logically dividing a database?
• What is the malicious software used to carry out ransom attacks called?
• What process involves regularly checking and updating security measures in software?
• What is defined as a flaw or weakness in software that can be exploited by attackers?
• What database model utilizes object-oriented programming concepts to organize and store data?
• What type of testing verifies that recent changes in a system haven't introduced new errors?
• What does a risk assessment process involve in software development?
• In a traditional software development lifecycle model, which phase typically involves coding?
• What is a notable characteristic of COTS applications?
• Which security concept emphasizes identifying, assessing, and mitigating risks?
• What does a comprehensive security assessment consider regarding a system?
• What is meant by vulnerability disclosure?
• What form of programming focuses on the sequence of operations rather than data structures?
• What is the focus of software (quality) assurance?
• In object-oriented programming, what is the term for a blueprint to create objects?
• What is the term used to describe the ability of an object to take many forms based on its usage?
• What is the purpose of dynamic testing in the context of software security?
• Which term refers to the act of extracting useful insights from large sets of data?
• What is the primary purpose of reputation monitoring in cybersecurity?
• What does CORBA stand for?
• Which concept refers to the efficient and effective management of information in an enterprise?
• What kind of attack involves the use of malformed inputs aimed at disrupting system functionality?
• What does a typical incident response plan include?
• What are security metrics primarily used for in software development?
• What role do code reviews play in software security?
• Markup Languages are primarily used for what purpose?
• What term refers to the total set of penetrations of a boundary surrounding system elements?
• What is the primary function of bots in mobile code applications?
• Which of the following concepts supports reusing code across different objects in object-oriented programming?
• Which of the following techniques is primarily used to find meaningful patterns and insights within data sets?
• Which aspect is crucial for protecting sensitive data in a software environment?
• Which stage in the traditional software development lifecycle comes after requirements definition?
• Continuous Integration and Continuous Delivery (CI/CD) aims to improve what aspect of software development?
• What defines the 'waterfall' software development model?
• What does the term ‘software libraries’ refer to in software development?
• Which development methodology uses fewer formal processes to deliver applications more rapidly?
• A program designed to hide its presence while copying itself across systems is commonly referred to as what?