Identify Undocumented Functionality CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a primary security risk associated with undocumented functionality?

   • AIt makes the user interface more intuitive
   • BIt reduces the need for regular software updates
   • CIt always increases the system's performance
   • DIt can provide unauthorized access to the system
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is tasked with identifying undocumented functionality in a large, complex application. The analyst has access to the source code and the ability to run the application in a test environment. Which approach would be most effective in discovering hidden features that are not apparent from normal usage?

   • AUse a network sniffer to capture all traffic between the application and its backend
   • BRun the application with a standard user account and observe all menu options
   • CReview the application's user manual and online help files
   • DPerform a manual code review focusing on conditional compilation flags and debug routines
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A software company is about to release a product that includes a third-party library. The library has an undocumented feature that, when activated, sends usage statistics to the library's developer. The feature is not mentioned in the library's documentation. The company's legal team is concerned about data privacy regulations. What is the most appropriate course of action?

   • ADisable the undocumented feature if possible, and if not, replace the library with an alternative
   • BContact the library's developer and ask them to remove the feature
   • CDocument the feature in the product's privacy policy and release the product
   • DRelease the product as planned because the feature is in a third-party library and not the company's responsibility
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software development team is preparing a product for release. During the final code review, they find a configuration flag that, when set, enables a 'maintenance mode' that bypasses all security checks. The flag is not mentioned in any documentation. What is the most likely reason this undocumented functionality exists?

   • AIt was introduced by a compiler optimization that altered the code
   • BIt was intentionally added by a developer as a backdoor for future access
   • CIt was created by a third-party library that was integrated into the application
   • DIt was added as a developer convenience for testing and accidentally left in the release
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is the best example of undocumented functionality in a software application?

   • AA hidden administrative command that is not listed in the user manual or help system
   • BA public API endpoint that is described in the official developer documentation
   • CA configuration option that is visible in the settings menu but has no effect
   • DA feature that is announced in the release notes but not yet fully implemented
   Reveal Solution Discussion Select an answer first