8.5 - Define and Apply Secure Coding Guidelines and Standards CISSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which secure coding practice is most effective at preventing cross-site scripting (XSS) vulnerabilities?

   • AInput validation
   • BOutput encoding
   • CRate limiting
   • DError handling
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is exposing an API that allows partners to submit bulk data. The API uses OAuth 2.0 with client credentials for authentication. A partner reports that their requests are being rejected with HTTP 429 Too Many Requests. The API team wants to allow legitimate partners to increase their throughput without compromising security. What is the most appropriate action?

   • AIncrease the rate limit for all partners and add a retry-after header to responses.
   • BRemove rate limiting entirely to avoid blocking legitimate partners.
   • CImplement a token bucket algorithm with per-client limits and allow partners to request a higher quota through a review process.
   • DUse a global rate limit that is high enough for the largest partner.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer is writing a C function that copies user-supplied data into a fixed-size buffer. The developer knows the input length is checked before the copy, but the check uses an unsigned integer and the length value comes from an external header field. Which secure coding practice should the developer apply to prevent a buffer overflow?

   • AAdd a comment in the code stating that the input length must not exceed the buffer size.
   • BIncrease the buffer size to accommodate the maximum possible header field length.
   • CUse a safe string copy function that takes the destination buffer size and rejects overlong inputs.
   • DCast the length to a signed integer before the comparison to avoid unsigned wrap-around.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A developer is implementing a login form. The current code compares the entered password to the stored password using a simple string equality check. What is the most important secure coding improvement?

   • AStore the password in a database column with a length of 255 characters.
   • BHash the password with MD5 before comparison.
   • CAdd a CAPTCHA to the login form.
   • DUse a constant-time comparison function to prevent timing attacks.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security review of a web application found that error messages reveal the database schema and that the application logs sensitive data such as credit card numbers in plaintext. The team must remediate both issues while preserving the ability to troubleshoot production incidents. Which approach best balances security and operability?

   • AReturn detailed error messages only to users with an admin role.
   • BEncrypt the logs at rest but continue logging sensitive data.
   • CReturn generic error messages to users and implement structured logging that redacts sensitive fields.
   • DDisable all error logging and rely on user reports to identify issues.
   Reveal Solution Discussion Select an answer first