Software Development Security GISP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which secure coding practice is most effective at preventing SQL injection attacks when building a database query with user-supplied input?

   • AUsing a stored procedure with dynamic SQL
   • BUsing parameterized queries (prepared statements)
   • CEscaping all single quotes in the input
   • DStoring input in a separate table before querying
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevOps team wants to integrate security testing into their CI/CD pipeline without slowing down development. They currently run unit tests and build artifacts. Which approach best balances security and speed?

   • ADisable security checks until the final release to avoid slowing down the pipeline.
   • BRun SAST and dependency scanning in parallel with the build, and fail the pipeline only on critical findings.
   • CDeploy to production first and then run security scans.
   • DRun a full penetration test on every code commit.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security-focused code review is being conducted on a Python web application. The reviewer finds that the application uses the `eval()` function on data received from an HTTP request. Which of the following is the most appropriate recommendation?

   • ALog all calls to `eval()` for auditing purposes.
   • BSanitize the input by removing all parentheses and brackets before passing it to `eval()`.
   • CWrap the `eval()` call in a try-except block to catch exceptions.
   • DRemove the use of `eval()` and replace it with a safe parsing library or allowlist-based logic.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which threat modeling technique involves drawing a data flow diagram (DFD) to identify trust boundaries, data flows, and entry points, then systematically applying a set of threat categories to each element?

   • ACVSS
   • BSTRIDE
   • COCTAVE
   • DPASTA
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security architect is leading a threat modeling exercise for a new online payment application. The team has drawn a data flow diagram showing that the application accepts payment card data from users, processes it through a middleware service, and stores it in a database. The architect wants to prioritize threats based on risk. Which approach best aligns with threat modeling principles?

   • AAsk the development team to list any security issues they have encountered in previous projects and address those first.
   • BIdentify all possible threats using a structured method like STRIDE, then rank them by likelihood and impact to focus on the highest-risk items.
   • CWait until the application is deployed and then run a vulnerability scanner to identify real-world threats.
   • DFocus only on threats that have been exploited in the organization before, as those are the most likely to occur again.
   Reveal Solution Discussion Select an answer first