NEW
Font size
WorksheetsCISSP Domain 8
Total questions: 10
Worksheet time: 50mins
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
After the system preliminary design has been developed and the data security categorization has been performed
the vulnerability analysis has been performed and before the system detailed design begins
After the system preliminary design has been developed and before the data security categorization begins
After the business functional analysis and the data security categorization have been performed
Which of the following is the BEST method to prevent malware from being introduced into a production environment?
Purchase software from a limited list of retailers
Verify the hash key or certificate key of all updates
Do not permit programs, patches, or updates from the Internet
Test all new software in a segregated environment
The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life
Cycle (SDLC)?
System acquisition and development
System operations and maintenance
System initiation
System implementation
What is the BEST approach to addressing security issues in legacy web applications?
Debug the security issues
Migrate to newer, supported applications where possible
Conduct a security assessment
Protect the legacy application with a web application firewall
Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?
Check arguments in function calls
Test for the security patch level of the environment
Include logging functions
Digitally sign each application module
An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requirement is
organization policy.
industry best practices.
industry laws and regulations.
management feedback.
Which of the following best explains how an attacker could steal a user’s session cookie and perform session hijacking?
By injecting malicious JavaScript code into a vulnerable web page (Cross-Site Scripting) that sends the victim’s cookie to the attacker’s server.
By capturing unencrypted HTTP traffic on a public Wi-Fi network and extracting the session ID contained in the cookie.
By creating a fake login page (phishing site) that tricks the user into submitting their credentials and automatically sets a session cookie known to the attacker.
By using malware installed on the hacker’s device that reads browser-stored cookies directly from the local file system
A security evaluation report and an accreditation statement are produced in which of the following phases of the system development life cycle?
project initiation and planning phase
system design specification phase
development & documentation phase
acceptance phase
What is an example of Hardcoded Credentials?
A developer places the database password directly in the source code and commits it to GitHub.
A user reuses the same password across multiple websites, making it vulnerable to credential stuffing.
An administrator leaves the default “admin/admin” login unchanged on a production server.
A system transmits credentials in clear text over HTTP instead of HTTPS.
How does Data Masking differ from Encryption?
Data masking creates substitute values that look real but are not the actual data, while encryption scrambles the data into unreadable ciphertext.
Data masking is mainly used in production systems, while encryption is only for development environments.
Data masking ensures confidentiality by using cryptographic algorithms, while encryption relies on substituting values that look genuine but are fake.
Both data masking and encryption can be reversed to reveal the original values, but encryption is faster for large datasets.
