A development team is setting up a new project and wants to automate the process of checking code for security issues every time a developer pushes changes to the shared repository. Which tool set should they configure?

A manual checklist that developers must complete before pushing code.

A network firewall that restricts access to the repository.

A local code editor with syntax highlighting and auto-completion.

A CI server that triggers a SAST scan on every push and reports the results to the development team.

Which development tool is specifically designed to identify security vulnerabilities in source code before the application is run?

Static Application Security Testing (SAST) tool

What is the primary security risk when using third-party libraries in software development?

They increase the size of the compiled executable.

They require a license for commercial use.

They may contain known or unknown vulnerabilities.

They slow down the development process.

Which of the following is a security consideration when configuring a runtime environment for a web application?

Allowing all network connections to the runtime

Using the default configuration for all settings

Disabling unnecessary services and features

Enabling detailed error messages for easier debugging

Which of the following is a common output of a Software Composition Analysis (SCA) scan?

A list of known vulnerabilities in the third-party libraries used by the application

A report of the application's response time under load

A list of all network connections made by the application

A list of vulnerabilities found in the application's custom code

Certified Information Systems Security Professional

Domain 8Objective 2

8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 4)

Part of the Software Development Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

10%of the exam

12 Concepts in This Objective

Programming Languages
Libraries
Tool Sets
Integrated Development Environment (IDE)
Runtime Environment
Continuous Integration and Continuous Delivery (CI/CD)
Software Configuration Management (CM)
Code Repositories
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Software Composition Analysis (SCA)
Interactive Application Security Testing (IAST)

Questions 16–20

16application · medium
A development team is setting up a new project and wants to automate the process of checking code for security issues every time a developer pushes changes to the shared repository. Which tool set should they configure?
Select an answer first
17foundation · easy
Which development tool is specifically designed to identify security vulnerabilities in source code before the application is run?
Select an answer first
18foundation · easy
What is the primary security risk when using third-party libraries in software development?
Select an answer first
19foundation · easy
Which of the following is a security consideration when configuring a runtime environment for a web application?
Select an answer first
20foundation · easy
Which of the following is a common output of a Software Composition Analysis (SCA) scan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.