8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a CI/CD pipeline, where should security scanning be integrated to catch vulnerabilities early?

   • AOnly after deployment to production
   • BOnly during the build stage
   • COnly in the production environment
   • DAt every stage of the pipeline, from code commit to deployment
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A quality assurance team is testing a web application and wants to identify vulnerabilities that are caused by the interaction of specific code paths and user input, such as a stored cross-site scripting (XSS) flaw that only triggers when a particular form is submitted. They need detailed information about the exact line of code that causes the issue. Which testing approach provides this level of detail?

   • ARun a SAST tool on the source code to find all potential XSS sinks in the application.
   • BRun an IAST tool that is instrumented within the application and monitors data flow during the test execution.
   • CRun an SCA tool to check the version of the web framework used by the application.
   • DRun a DAST tool that performs a comprehensive scan of the application's URLs and forms.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a policy that all source code must be reviewed by at least one other developer before it is merged. The team uses a Git repository with a main branch. Recently, a developer accidentally pushed a commit directly to main, bypassing the review process. The security team wants to enforce the policy so this cannot happen again. Which control should be implemented?

   • AChange the main branch to read-only for all developers and have an administrator merge all changes manually.
   • BSend a reminder email to all developers about the code review policy.
   • CEnable a branch protection rule on main that requires pull requests and at least one approval before merging.
   • DRevert the accidental commit and ask the developer to create a pull request.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary security goal of software configuration management (CM)?

   • ATo ensure that the software is developed quickly
   • BTo automatically fix security vulnerabilities
   • CTo reduce the number of developers needed
   • DTo maintain the integrity and traceability of software artifacts
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A development team uses several open-source JavaScript libraries in a client-side application. The security team is concerned about known vulnerabilities in these libraries. The team wants an automated way to detect these issues every time a developer builds the project locally. Which control should be implemented?

   • AConfigure the IDE to disable auto-completion for third-party libraries.
   • BRun a DAST scan against the application in a browser after the build completes.
   • CAdd an SCA plugin to the build tool that checks the package manifest against vulnerability databases and fails the build on critical findings.
   • DUse a code obfuscation tool to make the JavaScript libraries harder to exploit.
   Reveal Solution Discussion Select an answer first