A development team is using a third-party open-source library in their application. The team discovers that the library has a known critical vulnerability. The library is no longer maintained by its original developers. Which of the following is the MOST appropriate risk mitigation strategy?

Replace the library with a maintained alternative.

Apply a patch from the original developers.

Implement a WAF rule to block attacks against the vulnerability.

Continue using the library and accept the risk.

What is the key difference between qualitative and quantitative risk analysis?

Qualitative is performed by automated tools, while quantitative is performed by humans

Qualitative uses subjective ratings (e.g., high/medium/low), while quantitative uses numerical values (e.g., monetary loss)

Qualitative is used only for software, while quantitative is used only for hardware

Qualitative is always more accurate than quantitative

What is the primary goal of evaluating the effectiveness of security controls?

To prove that the software has no vulnerabilities

To replace the need for regular security audits

To increase the cost of the security program

To determine whether the controls reduce risk to an acceptable level

What is the primary goal of change logging and monitoring in software security?

To detect unauthorized modifications to software, configurations, and data

To ensure that all code changes are reviewed by at least two developers

To automatically roll back any change that causes a performance degradation

To replace the need for regular backups of application data

A project manager is planning the development of a new mobile banking application. The team has identified a risk that a developer might inadvertently introduce a SQL injection vulnerability. Which risk mitigation strategy is MOST effective in reducing this risk during the development phase?

Purchasing a cybersecurity insurance policy to cover potential losses.

Deploying a web application firewall (WAF) in front of the application.

Conducting a penetration test after the application is deployed.

Providing secure coding training to all developers and enforcing code review.

Certified Information Systems Security Professional

Domain 8Objective 3

8.3 - Assess the Effectiveness of Software Security CISSP Practice Questions (Page 1)

Part of the Software Development Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

10%of the exam

Questions 1–5

1application · medium
A development team is using a third-party open-source library in their application. The team discovers that the library has a known critical vulnerability. The library is no longer maintained by its original developers. Which of the following is the MOST appropriate risk mitigation strategy?
Select an answer first
2foundation · easy
What is the key difference between qualitative and quantitative risk analysis?
Select an answer first
3foundation · easy
What is the primary goal of evaluating the effectiveness of security controls?
Select an answer first
4foundation · easy
What is the primary goal of change logging and monitoring in software security?
Select an answer first
5application · medium
A project manager is planning the development of a new mobile banking application. The team has identified a risk that a developer might inadvertently introduce a SQL injection vulnerability. Which risk mitigation strategy is MOST effective in reducing this risk during the development phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.