A security engineer is conducting a security assessment of a web application. The engineer has access to the source code and wants to identify any undocumented functionality that might exist. Which of the following actions would be most effective in this effort?

Search the source code for strings like 'debug', 'test', 'backdoor', and 'TODO'

Review the application's user manual and online help files

Run the application and click through all the menus in the user interface

Perform a network scan of the application's hosting server

What is an appropriate remediation strategy for undocumented functionality that is no longer needed?

Leave it in place and hope no one discovers it

Document it in the user manual but keep it active

Disable it only in the production environment

Remove the code that implements the undocumented functionality

A security team is testing a new web application for hidden functionality before deployment. They have access to the source code and the running application. Which combination of techniques would be most effective in uncovering undocumented functionality?

Static analysis of the source code and dynamic analysis of the running application

Only fuzzing the application's input fields

Only reviewing the application's documentation and user manuals

Performing a network vulnerability scan of the hosting server

Which of the following is a static analysis technique that can help uncover undocumented functionality in source code?

Sending random inputs to the application's API

Running the application and observing its behavior

Scanning the code for suspicious patterns such as hardcoded credentials or debug statements

Monitoring network traffic during application use

A development team discovers that a third-party component used in their application contains an undocumented feature that sends telemetry data to an external server. The feature is not mentioned in the component's documentation. What is the most appropriate action for the team to take?

Replace the third-party component with a different one that does not have this feature

Ignore the feature because it is in a third-party component and not the team's responsibility

Document the feature in the application's user manual

Disable the undocumented feature if possible, and if not, replace the component

Certified Secure Software Lifecycle Professional

Domain 6Objective 4

Identify Undocumented Functionality CSSLP Practice Questions (Page 2)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

14%of the exam

Questions 6–10

6application · medium
A security engineer is conducting a security assessment of a web application. The engineer has access to the source code and wants to identify any undocumented functionality that might exist. Which of the following actions would be most effective in this effort?
Select an answer first
7foundation · easy
What is an appropriate remediation strategy for undocumented functionality that is no longer needed?
Select an answer first
8application · medium
A security team is testing a new web application for hidden functionality before deployment. They have access to the source code and the running application. Which combination of techniques would be most effective in uncovering undocumented functionality?
Select an answer first
9foundation · easy
Which of the following is a static analysis technique that can help uncover undocumented functionality in source code?
Select an answer first
10application · medium
A development team discovers that a third-party component used in their application contains an undocumented feature that sends telemetry data to an external server. The feature is not mentioned in the component's documentation. What is the most appropriate action for the team to take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.