8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is evaluating testing tools for a critical application. They need to identify vulnerabilities that are only visible during execution, such as business logic flaws, and they also need to know the exact code path that leads to the flaw. The team has a limited budget and cannot afford to run both a SAST and a DAST tool. Which approach best meets their needs?

   • AUse an SCA tool to check the application's dependencies for known vulnerabilities.
   • BUse a DAST tool that sends a wide range of malicious inputs to the application.
   • CUse a SAST tool that analyzes the source code for potential business logic flaws.
   • DUse an IAST tool that is instrumented in the application and monitors data flow during functional testing.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A development team is using a SAST tool in their CI/CD pipeline. The tool is generating a large number of false positives, which is causing developers to ignore the results. The security team wants to reduce the noise while still catching real vulnerabilities. Which approach best balances these concerns?

   • AIncrease the severity threshold so that only critical vulnerabilities are reported.
   • BDisable the SAST tool and rely on manual code reviews to find vulnerabilities.
   • CTune the SAST tool's rules to the application's specific technology stack and suppress known false positives.
   • DConfigure the SAST tool to only report vulnerabilities that are in the OWASP Top 10 and suppress the rest.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a key advantage of Interactive Application Security Testing (IAST) over traditional SAST and DAST?

   • AIt can be run without a running application
   • BIt does not require access to the application's source code
   • CIt can identify vulnerabilities with lower false positives by correlating runtime behavior with code paths
   • DIt only tests third-party components
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the most effective way to protect source code stored in a code repository from unauthorized access?

   • AEncrypting the entire repository with a single shared password
   • BStoring the repository on a USB drive
   • CImplementing role-based access control (RBAC) with least privilege
   • DMaking the repository public to encourage community review
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is deploying a Java application to a server. The application uses reflection to load classes dynamically. The security team is concerned about the risk of an attacker exploiting the reflection mechanism to execute arbitrary code. Which runtime control is most effective in mitigating this risk?

   • ARun the application under a security manager that restricts the permissions of the reflection API.
   • BObfuscate the application's bytecode to make it harder to reverse engineer.
   • CUse a newer version of the Java runtime that has performance improvements.
   • DStore the application's source code in a private repository with strict access controls.
   Reveal Solution Discussion Select an answer first