8.5 - Define and Apply Secure Coding Guidelines and Standards CISSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary goal of software-defined security?

   • ATo implement security controls as programmable, automated components
   • BTo replace all hardware firewalls with software firewalls
   • CTo make security controls static and unchangeable
   • DTo eliminate the need for security testing
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common source-code weakness that occurs when a program writes data beyond the boundary of an allocated memory buffer?

   • ASQL injection
   • BCross-site scripting (XSS)
   • CInsecure deserialization
   • DBuffer overflow
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A development team is using a third-party component that has a known critical vulnerability. The component is widely used and a patch is not yet available. The application is internet-facing. Which action is the most appropriate risk mitigation?

   • AIncrease the logging level to detect exploitation attempts.
   • BRemove the component from the application immediately.
   • CImplement a virtual patch using a web application firewall (WAF) rule that blocks the attack pattern.
   • DDisable the application until the patch is available.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A developer is implementing a search feature that accepts a user query and inserts it into a SQL LIKE clause. The current code uses string concatenation. The team wants to prevent SQL injection while preserving the ability to use wildcards (e.g., % and _) in the search. Which approach is the most secure?

   • AUse a parameterized query and escape the wildcard characters in the user input before passing it as a parameter.
   • BAllow only alphanumeric characters in the search query.
   • CUse a stored procedure that builds the query dynamically.
   • DContinue using concatenation but wrap the user input in a function that strips all special characters.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company exposes a public REST API for its mobile app. The API currently accepts any JSON payload and returns detailed error messages that include stack traces. The security team wants to reduce the risk of injection attacks and information leakage. Which combination of controls should be implemented?

   • ALog all requests and responses to a SIEM for later analysis.
   • BRate-limit requests per IP address to prevent brute force attacks.
   • CUse HTTPS and require an API key in every request.
   • DValidate all input against a strict schema and return generic error messages to clients.
   Reveal Solution Discussion Select an answer first