Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Secure SDLCSwitch
All CISSP topics

8.0 Software Development Security

Secure SDLC Practice Questions

SDLC models, DevSecOps, maturity models, secure coding standards, and software acquisition risk.

One solved question, so you can see how these are marked

A program manager is selecting an SDLC approach for a safety-sensitive system whose requirements are expected to change as prototypes are evaluated. Which approach BEST balances iterative learning with explicit attention to risk?

Spiral, because each iteration includes explicit risk analysis and prototyping.

The spiral model uses repeated cycles that include objectives, risk analysis, development, and evaluation, making it suitable when uncertainty and risk are significant. Waterfall is sequential, Agile does not inherently eliminate risk analysis, and DevOps addresses collaboration and delivery rather than replacing the SDLC risk process.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Secure SDLC questions in this set

Answers and explanations appear when you work through the set above.

  1. What is the PRIMARY security benefit of adopting DevSecOps in a continuous delivery environment?

    • Security responsibilities remain exclusively with a central security team.
    • Security review occurs only after the production release is complete.
    • Security practices and automated feedback span development and operations.
    • Developers are prohibited from changing code after the first sprint.

  2. A security manager wants an organization-wide view of software assurance strengths and a roadmap for improvement across governance, design, implementation, verification, and operations. Which model is MOST appropriate?

    • OWASP SAMM, a software assurance maturity and improvement model
    • The waterfall SDLC model with sequential phase gates and milestone reviews
    • A source code compiler warning report
    • A configuration item naming convention

  3. Which statement BEST describes a CMMI maturity level?

    • It certifies that every individual application is free of vulnerabilities.
    • It measures only the technical skill of the development team.
    • A staged indication of organizational process capability and improvement.
    • It is a list of mandatory programming language features.

  4. A product team is defining security requirements for a new medical application. Which action by an integrated product team is the BEST first step?

    • Wait until coding is complete, then ask operations to perform a vulnerability scan.
    • Joint requirements and risk definition by business, development, security, testing, legal, and operations.
    • Give the senior programmer sole authority to set security requirements without cross-functional review or consultation.
    • Purchase a commercial scanner and use its default rules as the requirements before defining the application's security objectives.

  5. Which secure coding practice MOST directly reduces the risk that untrusted input changes the meaning of a database command?

    • Parameterized queries with contextual input validation.
    • Store database passwords in the application's source repository.
    • Rely on client-side validation because server-side validation adds latency.
    • Disable database logging to prevent disclosure of query details.

  6. A developer requests an urgent production change to address a suspected security flaw. What should the change manager do FIRST?

    • Allow the developer to make the change directly and document it later.
    • Reject the request because emergency changes are never permitted.
    • Assess emergency change risk, approval, testing, and rollback.
    • Delete the previous release and rollback artifacts from the repository to prevent redeployment of the suspected flaw.

  7. Which control BEST supports the integrity and reproducibility of a software build?

    • Permit developers to overwrite release artifacts in place.
    • Keep source code on individual workstations without version history.
    • Version-controlled source and build definitions, restricted access, and traceable approved releases.
    • Let CI fetch unpinned dependencies from public sites at build time and treat a successful download as integrity verification.

  8. Before acquiring a cloud-hosted commercial application that will process regulated data, which action is MOST important for the security manager?

    • Rely on the supplier's marketing statement that it is secure.
    • Assess supplier security, assurance, incident duties, data handling, and contracts against organizational risk.
    • Require complete disclosure of proprietary source code to every customer, treating availability of that code as sufficient supplier assurance.
    • Skip assessment because cloud providers are responsible for all customer security.

  9. An organization wants a common, outcome-based baseline for its developers and suppliers that addresses preparing the organization, protecting software, producing well-secured software, and responding to vulnerabilities. Which reference BEST fits this need?

    • NIST SSDF for software security practices and vulnerability response
    • A project sprint burndown chart of the remaining development effort
    • A network firewall rule set
    • A user interface style guide