8.5 - Define and Apply Secure Coding Guidelines and Standards CISSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is adopting a policy-as-code approach to enforce security standards across its development teams. The security team wants to ensure that all new code is scanned for secrets before it is merged. Which tool integration is the most effective?

   • ARequire developers to manually review their code for secrets before pushing.
   • BAdd a secret-scanning tool to the CI/CD pipeline that fails the build on any detected secret.
   • CScan the codebase once a month for secrets.
   • DUse a pre-commit hook that warns developers but does not block the commit.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which secure coding practice is most effective at preventing SQL injection vulnerabilities?

   • AUsing parameterized queries or prepared statements
   • BEncoding all output
   • CImplementing proper error handling
   • DUsing strong authentication
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does software-defined security integrate security controls into the software development lifecycle (SDLC)?

   • ABy automating security checks and policy enforcement within CI/CD pipelines
   • BBy eliminating the need for security testing
   • CBy performing security reviews only after deployment
   • DBy requiring all security controls to be implemented in hardware
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security audit of a web application found that the application is vulnerable to command injection. The vulnerable code passes user input directly to a system shell command. The team must fix this while preserving the ability to perform the intended operation. Which remediation is the most secure?

   • AValidate the user input against a whitelist of allowed characters.
   • BEscape all shell metacharacters in the user input before passing it to the command.
   • CRun the shell command with the lowest possible privileges.
   • DReplace the shell command with a well-defined API or library function that does not invoke a shell.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is adopting a DevOps model and wants to integrate security checks into its CI/CD pipeline. The goal is to catch common vulnerabilities early without slowing down developers. Which approach best exemplifies software-defined security?

   • AProvide security awareness training to all developers once a year.
   • BRequire a manual security review by a penetration tester before every production release.
   • CDeploy a web application firewall (WAF) in front of all applications.
   • DRun static application security testing (SAST) as an automated step in the pipeline and fail the build on critical findings.
   Reveal Solution Discussion Select an answer first