Software Development Security GISP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common focus area when conducting a security code review?

   • AVariable naming conventions
   • BCode indentation and spacing
   • CNumber of lines per function
   • DInput validation and output encoding
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A DevOps team is adopting a DevSecOps approach for a containerized application. They want to automatically identify known vulnerabilities in the container images before they are deployed to the production environment. Which control should be integrated into the CI/CD pipeline?

   • AScan the production environment weekly with a network vulnerability scanner.
   • BRely on the container registry's built-in encryption to protect images.
   • CRun a container image scanner that checks against vulnerability databases during the build stage.
   • DPerform a manual security review of the Dockerfile before each release.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is building a customer-facing web application that accepts file uploads from users. During a security-focused code review, a reviewer notices that the application constructs SQL queries by concatenating user-supplied filenames directly into a database query. The team is in the coding phase of the SDLC and wants to remediate this before the next build. Which action best addresses the vulnerability while aligning with secure coding practices?

   • ADefer the fix until the testing phase so that a penetration test can confirm the vulnerability.
   • BSanitize the filename by removing all non-alphanumeric characters before using it in the query.
   • CAdd a web application firewall (WAF) rule to block requests that contain SQL keywords in the filename.
   • DUse parameterized queries with bound parameters for all database access involving user input.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During the maintenance phase of a software system, which activity is essential to protect against newly discovered vulnerabilities?

   • AIncreasing the system's processing speed
   • BRemoving all user accounts
   • CApplying security patches and updates promptly
   • DDisabling all logging
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice helps mitigate supply chain risks by verifying the integrity and origin of third-party components?

   • ARelying solely on the vendor's reputation
   • BDisabling all third-party components
   • COnly using components from the same country
   • DUsing a software bill of materials (SBOM) and verifying checksums/signatures
   Reveal Solution Discussion Select an answer first