Software Development Security GISP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security architect is leading a threat modeling exercise for a new online payment application. The team has identified that an attacker could modify the price of an item by tampering with a hidden form field. Which threat modeling technique would most directly help the team systematically identify and rank this and similar threats?

   • AReview the application's error logs for past security incidents.
   • BAsk the development team to list all the features they think are risky.
   • CRun a fuzzing tool against the application's input fields to find crashes.
   • DUse the STRIDE model to categorize threats such as tampering and spoofing, then rank them by risk.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A threat modeling exercise for a financial application identifies a high-risk threat: an attacker could tamper with transaction amounts in transit. The team is considering two mitigations: (1) encrypting all traffic with TLS, and (2) implementing message authentication codes (MACs) on transaction data. The application already uses TLS for all communications. What is the most appropriate conclusion?

   • ATLS only provides confidentiality, so MACs are required to ensure integrity.
   • BThe threat cannot be mitigated because attackers can always break TLS.
   • CThe team should disable TLS and rely solely on MACs to reduce overhead.
   • DTLS provides confidentiality and integrity in transit, so the threat is already mitigated; additional MACs may be redundant but can provide defense-in-depth.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A DevOps team is implementing a DevSecOps pipeline for a microservices application. They want to ensure that security testing is automated and does not become a bottleneck. The team has a limited budget and cannot afford expensive commercial tools. Which combination of practices is most effective?

   • AUse open-source SAST and dependency scanning tools in the pipeline, and run DAST on a staging environment before major releases.
   • BRun all security tests manually once a month.
   • CSkip security testing and rely on the developers' experience.
   • DPurchase an expensive commercial suite and run it only on production.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary security goal when decommissioning a software system or disposing of its storage media?

   • AArchiving all data for future reference
   • BReformatting the hard drive once
   • CTransferring data to a third party for storage
   • DEnsuring that sensitive data is irrecoverably destroyed
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During a code review, a developer notices that a web application constructs SQL queries by concatenating user input directly into the query string. The application is written in Java and uses a relational database. Which remediation is the most effective secure coding practice to prevent SQL injection?

   • AEncode all user input using HTML entity encoding before building the query.
   • BStore all user input in a separate table and never use it in queries.
   • CAdd client-side JavaScript validation to ensure input contains only letters and numbers.
   • DUse parameterized queries or prepared statements for all database access.
   Reveal Solution Discussion Select an answer first