Software Development Security GISP Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company is deploying a new version of its web application to production. The deployment pipeline is automated, but the security team is concerned about misconfigurations and unpatched components. Which practice should be integrated into the deployment process to address these concerns?

   • ADisable all security controls during deployment to avoid interfering with the process.
   • BAutomate configuration validation and vulnerability scanning of the application and its dependencies before release.
   • CManually review the configuration files after deployment to ensure they are correct.
   • DDeploy the application and then apply patches only if a vulnerability is discovered.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company is developing a mobile application that uses a third-party SDK for analytics. The SDK is known to collect user data and transmit it to the vendor's servers. The company's privacy policy states that user data is not shared with third parties. The legal team is concerned about compliance. What is the most appropriate action?

   • AUse the SDK only in the development build, not in the production release.
   • BConfigure the SDK to disable data collection features.
   • CKeep the SDK but update the privacy policy to disclose data sharing.
   • DReplace the SDK with an open-source alternative that can be self-hosted and does not transmit data externally.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   During a security-focused code review, a reviewer finds that a web application uses a JavaScript function to validate user input on the client side, but the server does not perform any validation. The application accepts user comments and displays them to other users. What is the most important issue to address?

   • AThe application should store comments in a database instead of in memory.
   • BThe JavaScript validation should be moved to a separate file to improve maintainability.
   • CThe application should use HTTPS to protect the comments in transit.
   • DThe lack of server-side validation allows stored XSS attacks because client-side validation can be bypassed.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A software company uses a third-party component in its product. The component's maintainer announces that they will no longer provide security updates. The company's product is widely deployed and cannot be easily replaced. What is the most appropriate risk mitigation?

   • AContinue using the component and hope that no vulnerabilities are discovered.
   • BImplement compensating controls such as network segmentation, input validation, and monitoring to reduce the risk of exploitation.
   • CImmediately remove the component and ship the product without that functionality.
   • DPurchase a commercial support contract for the component.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security code review is being conducted on a Java web application. The reviewer finds that the application uses a custom authentication filter that checks if a user is in a hardcoded list of admin usernames. The filter is applied to all requests except static resources. Which of the following is the most significant security flaw in this design?

   • AHardcoded admin usernames and a custom authentication mechanism are prone to bypass and maintenance issues.
   • BThe application uses Java, which is inherently secure.
   • CThe filter should be applied to static resources as well to prevent unauthorized access.
   • DThe filter is applied to all requests except static resources, which is a good practice.
   Reveal Solution Discussion Select an answer first