Which of the following is a common source of undocumented functionality in software?

Regularly scheduled security audits

Leftover debug code that was used during development but never removed

Well-maintained code comments that explain every function

The use of a standard authentication library

How can undocumented functionality lead to compliance violations?

By adding more features than the license permits

By reducing the number of user interface elements

By making the software run faster, which is not allowed by regulations

By exposing sensitive data through hidden features that are not accounted for in compliance assessments

A security team discovers an undocumented 'admin' account in a legacy application that is still in production. The account was created by a former employee and is not documented. The application is critical to business operations and cannot be taken offline for an extended period. What is the most appropriate immediate action?

Change the account's password and monitor its usage

Disable the account immediately and remove the associated code

Leave the account as is and document it in the system documentation

Take the application offline immediately to remove the account

A penetration tester is assessing a web application for undocumented functionality. The tester has no access to the source code but can interact with the application. Which technique would be most effective in discovering hidden endpoints or debug interfaces?

Fuzzing the application's URL parameters and headers

Using a network scanner to identify open ports

Reviewing the application's source code if available

Probing common debug and admin paths such as '/admin', '/debug', and '/test'

Certified Secure Software Lifecycle Professional

Domain 6Objective 4

Identify Undocumented Functionality CSSLP Practice Questions (Page 5)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

14%of the exam

Questions 21–24

21foundation · easy
Which of the following is a common source of undocumented functionality in software?
Select an answer first
22foundation · easy
How can undocumented functionality lead to compliance violations?
Select an answer first
23expert · hard
A security team discovers an undocumented 'admin' account in a legacy application that is still in production. The account was created by a former employee and is not documented. The application is critical to business operations and cannot be taken offline for an extended period. What is the most appropriate immediate action?
Select an answer first
24application · medium
A penetration tester is assessing a web application for undocumented functionality. The tester has no access to the source code but can interact with the application. Which technique would be most effective in discovering hidden endpoints or debug interfaces?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Identify Undocumented Functionality CSSLP Practice Questions (Page 5)

Questions 21–24

Which of the following is a common source of undocumented functionality in software?

How can undocumented functionality lead to compliance violations?

A penetration tester is assessing a web application for undocumented functionality. The tester has no access to the source code but can interact with the application. Which technique would be most effective in discovering hidden endpoints or debug interfaces?

Keep studying — Secure Software Testing