Software Development Security GISP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A development team is using an open-source library in their application. The library has a known critical vulnerability, but no patched version is available. The team must continue using the library for now. Which action is the most appropriate to mitigate the risk?

   • AIgnore the vulnerability because the library is open-source and widely used.
   • BImplement additional security controls such as input validation and network segmentation to reduce exploitability.
   • CRemove the library from the application immediately and rewrite all functionality from scratch.
   • DDisable all logging and monitoring to reduce the attack surface.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security tester is performing a penetration test on a web application. The tester has identified a potential SQL injection vulnerability in the login form. Which testing technique would best confirm the vulnerability and demonstrate its impact?

   • ACraft a SQL injection payload that causes a time delay or returns unexpected data to confirm the vulnerability.
   • BRun a port scan on the web server to identify open ports.
   • CCheck the web server's SSL certificate for validity.
   • DReview the application's source code for SQL queries.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which security testing method involves actively attempting to exploit vulnerabilities in a running application to determine the real-world impact and reachability of a flaw?

   • APenetration testing
   • BThreat modeling
   • CCode review
   • DStatic analysis
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application displays user-generated content on a public forum. The development team is concerned about cross-site scripting (XSS) attacks. Which secure coding practice is the most effective defense against stored XSS?

   • AUse a content security policy (CSP) that allows inline scripts from any source.
   • BEncode all user-generated content before rendering it in the browser.
   • CDisable JavaScript in the user's browser via a response header.
   • DStore user input in a database without any validation or encoding.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the core idea of DevSecOps?

   • AHaving a dedicated security team perform all security reviews after deployment
   • BSeparating security testing from the development process to avoid slowing down releases
   • CReplacing all manual security testing with automated tools
   • DIntegrating security practices into the DevOps pipeline to automate security checks and continuous monitoring
   Reveal Solution Discussion Select an answer first