What is the purpose of using secrets management tools (e.g., HashiCorp Vault) in a CI/CD pipeline?

To encrypt the entire CI/CD pipeline

To securely store and manage credentials, API keys, and other sensitive data used during the build and deployment process

To monitor the performance of the pipeline

Which of the following is a security advantage of using a strongly typed language like Java over a loosely typed language like JavaScript?

It eliminates the need for input validation.

It prevents all SQL injection attacks.

It guarantees the absence of runtime exceptions.

It reduces the likelihood of type confusion vulnerabilities.

Why is it important to keep the runtime environment (e.g., Java Virtual Machine, .NET CLR) updated with the latest security patches?

To ensure compatibility with the latest libraries

To fix known vulnerabilities that could be exploited by attackers

To improve the performance of the application

To reduce the memory footprint of the runtime

Why is it important to enable multi-factor authentication (MFA) for code repository accounts?

To encrypt the source code in the repository

To allow multiple users to share the same account

To prevent unauthorized access even if a password is compromised

Which testing approach is used to identify vulnerabilities in a running application by sending malicious inputs and observing the responses?

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST)

Software Composition Analysis (SCA)

Certified Information Systems Security Professional

Domain 8Objective 2

8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 1)

Part of the Software Development Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

10%of the exam

12 Concepts in This Objective

Programming Languages
Libraries
Tool Sets
Integrated Development Environment (IDE)
Runtime Environment
Continuous Integration and Continuous Delivery (CI/CD)
Software Configuration Management (CM)
Code Repositories
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Software Composition Analysis (SCA)
Interactive Application Security Testing (IAST)

Questions 1–5

1foundation · easy
What is the purpose of using secrets management tools (e.g., HashiCorp Vault) in a CI/CD pipeline?
Select an answer first
2foundation · easy
Which of the following is a security advantage of using a strongly typed language like Java over a loosely typed language like JavaScript?
Select an answer first
3foundation · easy
Why is it important to keep the runtime environment (e.g., Java Virtual Machine, .NET CLR) updated with the latest security patches?
Select an answer first
4foundation · easy
Why is it important to enable multi-factor authentication (MFA) for code repository accounts?
Select an answer first
5foundation · easy
Which testing approach is used to identify vulnerabilities in a running application by sending malicious inputs and observing the responses?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.