Study. uk . com
  1. Home
  2. All questions
  3. Software security

CISSP study material: Software security

50 questions of the 500 in the CISSP — Certified Information Systems Security Professional quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

  1. 28. A developer encrypts customer records with AES in Cipher Block Chaining (CBC) mode and derives each initialisation vector (IV) from the record's primary key, so that decryption can recompute the IV without storing it. A reviewer objects to the design. Which change should the reviewer require?
  2. 30. A protocol team needs a derivation step that emits 512 bits of keying material now and may need 1024 bits for a later revision, produced by a single primitive invocation rather than by concatenating several digests. The design is restricted to functions specified in FIPS 202. Which function meets the requirement?
  3. 51. A penetration test of an internal staff portal reports that the administrative menu is hidden by JavaScript for standard users, but a command-line HTTP client calling the /admin/users endpoint with an ordinary user's session returns the full staff list. Which remediation addresses the underlying broken access control?
  4. 61. A programme manager schedules the security control assessment for a new claims system as a single event in the week before the authorisation decision, arguing that any earlier assessment would examine an unfinished system. The assessment lead pushes back. Which correction should the lead offer?
  5. 73. A financial services firm runs three delivery groups: one on a waterfall life cycle, one on Scrum, and one on continuous delivery. The CISO wants a single consistent set of secure-development expectations across all three without forcing them onto one common life-cycle model. Which approach fits the Secure Software Development Framework (SSDF) as it is published?
  6. 74. A product group adopting the Secure Software Development Framework (SSDF) scans dependencies every build and patches reported flaws within days, yet its vulnerability count returns to the same level each release. An architect argues the programme still misses one of the framework's stated objectives. Which objective is the group overlooking?
  7. 75. A retail platform authenticates users with stateless JSON Web Tokens (JWTs) that live twelve hours. After an account takeover, support uses "log out all devices" and the attacker's token keeps working until it expires. The team must make logout effective while still letting ordinary customer sessions last a long time. Which design meets both goals?
  8. 76. While mapping findings against the OWASP Top 10:2025, an application team looks for the XML External Entities category it tracked in earlier editions and finds the category gone. Its document parser still resolves external entity references by default. Where does the 2025 list account for this weakness?
  9. 77. An identity team is replacing an unsalted SHA-256 password store for a new consumer application. Policy demands a scheme that resists offline cracking on rented GPUs and lets defenders raise the attacker's cost as hardware improves. Following OWASP's 2025 cryptographic guidance, which choice should the team make?
  10. 78. A payments service fails part way through a multi-step transfer: funds have left the source ledger and the destination write has errored. Developers propose a handler that retries the remaining step and, failing that, marks the transfer complete so a nightly job can reconcile it. Which handling matches OWASP's 2025 guidance on exceptional conditions?
  11. 79. At a software vendor, one maintainer can merge a change and deploy it to production without another reviewer, and every environment rebuilds the application from source before deployment. A poisoned upstream dependency recently reached the entire customer fleet within an hour. Which two changes align with OWASP's 2025 supply chain guidance? Choose two.
  12. 80. An architect is rewriting the transport security standard for a bank's public APIs ahead of an audit. Legacy clients still negotiate TLS 1.0 and cipher block chaining (CBC) suites, and the bank holds customer records that must stay confidential for decades. Under OWASP's 2025 cryptographic guidance, which two requirements belong in the standard? Choose two.
  13. 463. A team reads that injection has fallen in the 2025 OWASP Top 10 and concludes it is now a minor concern. Which two facts from the 2025 entry contradict that? Choose two.
  14. 464. Which description matches OWASP's 2025 definition of an injection vulnerability?
  15. 465. Why does OWASP's 2025 injection entry have a lower average weighted impact than the severity of SQL injection alone would suggest?
  16. 466. A team lists input validation and output escaping as its primary defences against injection. What does OWASP name as the preferred option?
  17. 467. A developer argues that moving all database access into stored procedures removes injection risk. Under what condition does OWASP say a stored procedure can still be injectable?
  18. 468. A reporting feature lets users pick which database table to report on by supplying its name. Why does OWASP treat this as dangerous even with parameterised values?
  19. 469. A team relies solely on positive server-side input validation to stop injection. Why does OWASP describe this as incomplete?
  20. 470. Which approach does OWASP describe as best for detecting injection? Choose two.
  21. 471. An application passes unsanitised user input into an object-relational mapper's search parameters. What does OWASP's 2025 injection entry say about this?
  22. 472. A team asks whether prompt injection against a language model falls inside the OWASP web application injection category. What is the position in the 2025 list?
  23. 473. A team plans to fix an insecure design by improving code review and static analysis. Why does OWASP say this will not work?
  24. 474. How does OWASP define insecure design in the 2025 Top 10?
  25. 475. OWASP names a factor that contributes to insecure design and explains why the design was never made secure enough. What is it?
  26. 476. Which three parts does OWASP give for having a secure design? Choose three.
  27. 477. Which activities does OWASP place in the requirements and resource management part of secure design? Choose three.
  28. 478. A payments flow lets a user apply a discount code an unlimited number of times because nobody defined which state transitions were disallowed. Which OWASP 2025 category does this fall under?
  29. 479. Where does OWASP say threat modelling belongs in an agile process, and what should it watch for?
  30. 480. A vendor markets a tool it says will deliver secure design for any application. How does OWASP characterise secure design?
  31. 481. An attacker holding a breach corpus tries each leaked password and then variants such as the same password with an incremented digit. Which two OWASP terms describe these attacks? Choose two.
  32. 482. A forgot-password flow asks the user for their mother's maiden name. What does OWASP's 2025 authentication entry say about such mechanisms?
  33. 483. An application issues a session identifier at first visit and keeps the same value after the user authenticates. Which two authentication failures does OWASP's 2025 entry describe here? Choose two.
  34. 484. A single sign-on integration leaves its tokens valid after the user logs out and after long periods of inactivity. How does OWASP classify this?
  35. 485. A service offers a code by voice call whenever the user's authenticator app is unavailable, with no further checks. Why does OWASP count this among authentication failures?
  36. 486. Which three practices does OWASP's 2025 authentication entry recommend? Choose three.
  37. 487. Which situations does OWASP's 2025 entry on software and data integrity failures describe? Choose three.
  38. 488. An application checks for updates over HTTPS and installs whatever the endpoint returns without verifying a signature. What consequence does OWASP describe?
  39. 489. A team serialises user state and passes it back and forth with each request to keep their services stateless. Which risk does OWASP's integrity failures entry identify?
  40. 490. An API accepts serialised objects from untrusted clients. Which condition does OWASP require before that data is used?
  41. 491. An organisation with a high risk profile pulls its dependencies directly from public package registries. What does OWASP recommend instead?
  42. 492. Which two build pipeline measures does OWASP name as integrity controls under its 2025 integrity failures entry? Choose two.
  43. 493. A company maps support.example.com onto a support provider's infrastructure for convenience. Which consequence does OWASP's example describe?
  44. 494. Home routers and set-top boxes that accept unsigned firmware are described by OWASP as a growing target. What does it say about remediating the problem?
  45. 495. An application logs successful logins but not failed ones. How does OWASP's 2025 logging entry treat this?
  46. 496. Which two shortcomings does OWASP identify where an application's logs live only on the machine that produced them? Choose two.
  47. 497. Why does OWASP require log data to be correctly encoded before it is written?
  48. 498. An application writes full patient records into its application log and shows recent log lines on an administrative page any authenticated user can open. Which two failures does OWASP identify? Choose two.
  49. 499. An operations centre receives thousands of alerts a day, most of them noise. How does OWASP's 2025 entry treat this situation?
  50. 500. An alert fires for a use case whose response playbook was written three years ago and never revised. What does OWASP say about this?