I85PREP
⌘ K
CISAW Secure Software study materials
CISAW Secure Software study resources

CISAW Secure Software practice questions

One question at a time. Build your CISAW Secure Software understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application and data protection

What is the primary coding control against SQL injection?

  1. Building SQL by concatenating untrusted strings into the query text
  2. Parameterized queries / prepared statements that keep data separate from SQL code Correct answer.
  3. Disabling the database entirely
  4. Printing the SQL to the browser so users can edit it

Explanation

Parameterized queries bind user values as data, not as SQL syntax. Concatenation is the classic injection defect. CISAW secure-coding topics treat injection as a core input-validation failure.

Question 2Application and data protection

The primary mitigation for XSS (cross-site scripting) in HTML applications is:

  1. Trusting all user-supplied markup in a rich-text field with no policy
  2. Disabling HTTPS so scripts cannot load
  3. Storing passwords in cookies named “xss”
  4. Contextual output encoding (and frameworks that auto-escape) so untrusted data cannot become HTML or script Correct answer.

Explanation

XSS happens when untrusted data is interpreted as markup or script. Encode for the output context (HTML body, attribute, JavaScript, URL). CSP is defense in depth, not a substitute for encoding.

Question 3Application and data protection

Which control best prevents CSRF (cross-site request forgery) on a cookie-authenticated state-changing request?

  1. Showing the company logo in the footer
  2. Using HTTP GET for every money-transfer action
  3. Turning off authentication so there is no session to forge
  4. An anti-CSRF token bound to the session, or equivalent SameSite and custom-header defenses for that design Correct answer.

Explanation

CSRF makes the browser attach cookies to a forged request. A synchronizer (or double-submit) token the attacker cannot read, plus SameSite cookies and avoiding state changes on GET, are standard defenses.

Question 4Application and data protection

Hard-coding a cloud access key in a public repository is primarily which defect?

  1. A harmless comment style
  2. A required Common Criteria trusted-path feature
  3. A GB/T rule that all keys must be public
  4. A secrets-management failure that can lead to account takeover Correct answer.

Explanation

Secrets belong in a vault or runtime injection, not in source. Public repos make leakage immediate; the key must be rotated. GB/T 39412 flags unprotected important configuration as an environmental defect.

Question 5Application and data protection

Authentication (authn) differs from authorization (authz) because:

  1. Authentication decides what an identified subject may do; authorization proves identity
  2. They are always the same function in every standard
  3. Authentication establishes identity; authorization decides what that identity may do Correct answer.
  4. Authorization is only a network cable color

Explanation

Authn answers “who is this?” Authz answers “what may they access?” Broken access control often appears when developers check login but not object-level permission.

Question 6Application and data protection

Setting the HttpOnly flag on a session cookie is intended to:

  1. Stop the browser from sending the cookie on any request
  2. Make the cookie readable to every third-party script
  3. Replace TLS
  4. Reduce theft of the cookie via client-side script (XSS) by blocking document.cookie access Correct answer.

Explanation

HttpOnly tells the browser not to expose the cookie to JavaScript. It does not stop the cookie from being sent on HTTP(S) requests, so it is not a CSRF control, and it is not a substitute for TLS or output encoding.

Question 7Application and data protection

Why is unsalted MD5 a defective way to store user passwords?

  1. MD5 is a slow memory-hard password KDF designed for password storage
  2. MD5 is fast, unsalted hashes are rainbow-table friendly, and MD5 is not an acceptable password hashing function Correct answer.
  3. MD5 automatically adds a unique per-user salt and pepper
  4. CISAW requires MD5 for all authentication modules

Explanation

Password storage needs a slow, salted one-way KDF (for example Argon2, bcrypt, scrypt, or PBKDF2 with adequate parameters). Fast unsalted MD5 is a cryptographic misuse still seen in legacy code.

Question 8Application and data protection

An integer overflow in a size calculation used for memory allocation is dangerous mainly because:

  1. It always improves performance legally required by GB/T
  2. Integers cannot overflow in any programming language
  3. It only affects GUI color palettes
  4. It can wrap to a too-small allocation, leading to buffer overflows when data is copied Correct answer.

Explanation

CISAW coding topics include integer defects. If length * count wraps, a small buffer may be allocated and a later copy writes out of bounds. Use checked arithmetic and safe size types.

Question 9Application and data protection

A C function copies a user-supplied string into a fixed 32-byte stack buffer without checking length. This is primarily:

  1. A recommended trusted-path implementation
  2. A buffer overflow / bounds-checking defect Correct answer.
  3. A harmless style warning with no security meaning
  4. Required by GB/T 39412 as a sample pattern

Explanation

Unbounded copies into fixed buffers are classic memory-safety defects in CISAW’s pointer/array/string topics. Use bounded copies, safer APIs, and compiler fortification-not an exploit payload in exam answers.

Question 10Application and data protection

During secure code review, which distinction between stored and reflected XSS most affects how a developer prioritizes the fix?

  1. Stored XSS is a server-side flaw and reflected XSS is a client-side flaw, so only stored XSS needs server-side encoding
  2. Reflected XSS is the only type that needs output encoding, because stored data is already trusted once it passes input validation
  3. Stored XSS is exploitable only by authenticated users, so it is always lower severity than reflected XSS
  4. Stored XSS is persisted (for example in a database) and later served to every user who views that data, so one payload can reach many victims; reflected XSS is echoed from a single crafted request and needs the victim to follow it Correct answer.

Explanation

Stored (persistent) XSS infects data at rest and is replayed to every later viewer, so the blast radius can include administrators and needs no phishing step; reflected XSS rides on a request that is immediately echoed back to whoever sent it. Both are fixed the same way - context-aware output encoding at the render point plus a strict CSP - but the wider victim set usually makes stored XSS the higher-severity finding to schedule first.

Question 11Application and data protection

Setting a session cookie’s SameSite attribute to Strict or Lax helps mainly against:

  1. SQL injection inside a stored procedure
  2. Cross-site request forgery by limiting when the browser attaches the cookie to cross-site requests Correct answer.
  3. Integer overflow in malloc
  4. Missing disk encryption on a laptop

Explanation

SameSite restricts cross-site cookie sending. Lax still sends cookies on top-level GET navigations; Strict is tighter. SameSite complements CSRF tokens; it is not an injection or memory-safety control.

Question 12Application and data protection

To avoid OS command injection, the safest pattern is:

  1. Concatenate untrusted input into a shell command string and run it
  2. Call APIs or argument arrays that do not invoke a shell, and allowlist any unavoidable arguments Correct answer.
  3. Prefix the user string with a comment character and hope the shell ignores it
  4. Run the application as root so the command always works

Explanation

Command injection happens when untrusted data becomes shell syntax. Prefer library APIs (file operations, image libraries) over shells; if a process must be spawned, pass argument vectors, not a concatenated command line, and allowlist values.

Question 13Application and data protection

A download feature joins a user-supplied relative path onto a document root. What is the primary defense against path traversal?

  1. Trust any string that contains the letters “file”
  2. URL-decode the path repeatedly until it looks interesting
  3. Store all user files on the web root with directory listing enabled
  4. Canonicalize the path, verify it stays inside the intended directory, and prefer an allowlist of identifiers over raw paths Correct answer.

Explanation

Path traversal uses sequences that escape the intended directory. Canonicalization plus a prefix check, or better, mapping IDs to stored names, is the coding control. Repeated decoding without a final canonicalize step is itself a bypass pattern.

Question 14Application and data protection

XML parsers that resolve external entities on untrusted input are associated with which defect class?

  1. XXE (XML External Entity) processing, which can disclose files or cause server-side requests Correct answer.
  2. A mandatory GB/T requirement to fetch all remote DTDs
  3. A CSS layout bug only
  4. A harmless pretty-printer feature

Explanation

XXE is prevented by disabling external entities and DTDs in the parser configuration, or by using formats that do not expand entities. CISAW web and input-validation topics include this class without needing a payload sample.

Question 15Application and data protection

Insecure deserialization is dangerous because untrusted data may:

  1. Only change a font size in a report
  2. Be converted into objects or code paths that invoke unexpected methods, sometimes leading to remote code execution or privilege abuse Correct answer.
  3. Automatically apply parameterized SQL
  4. Force HttpOnly cookies on all responses

Explanation

Native deserialization of untrusted streams can reconstruct unexpected types. Prefer simple data formats (JSON with explicit schemas) and integrity-protected tokens, not language-native pickle/Java serialization of attacker data.

Question 16Application and data protection

Why is AES in ECB mode a cryptographic misuse for encrypting structured data?

  1. ECB is the only FIPS-approved mode for all data
  2. ECB cannot encrypt more than one byte
  3. Identical plaintext blocks produce identical ciphertext blocks, leaking patterns Correct answer.
  4. ECB automatically provides integrity protection equal to AES-GCM

Explanation

ECB has no diffusion across blocks, so repeated plaintext shows in ciphertext. Prefer an authenticated mode such as AES-GCM with a unique nonce. CISAW cryptographic-support topics treat mode selection as part of secure design and coding.

Question 17Application and data protection

When hashing passwords, why must each user have a unique salt?

  1. So identical passwords do not produce identical hashes and precomputed tables cannot be reused across users Correct answer.
  2. So the application can decrypt the password for display
  3. Because salts replace the need for a slow KDF
  4. Because a global hardcoded salt in source is equivalent to unique per-user salts

Explanation

A unique random salt per credential prevents rainbow tables and hides whether two users share a password. The salt is stored with the hash; a slow KDF is still required. A single hardcoded salt is much weaker.

Question 18Application and data protection

Session fixation is best prevented by:

  1. Reusing the pre-login session identifier after authentication
  2. Issuing a new session identifier after successful authentication and invalidating the old one Correct answer.
  3. Putting the session identifier in the URL and in server logs
  4. Never expiring sessions so fixation cannot time out

Explanation

If the identifier stays the same across login, an attacker who planted it can inherit the authenticated session. Rotate the ID at privilege change, use cookie-based IDs, and set Secure/HttpOnly/SameSite.

Question 19Application and data protection

An API returns order 12345 to any logged-in user who requests /orders/12345 without checking ownership. This is primarily:

  1. Broken object-level authorization (IDOR-style) Correct answer.
  2. A correct implementation of complete mediation
  3. A CSRF token success story
  4. A side-channel timing attack on AES-GCM

Explanation

Login is not enough: the server must authorize that the subject may access that object. Direct object references without checks are a leading access-control defect in CISAW authorization topics.

Question 20Application and data protection

Returning full exception stack traces to end users in production mainly causes:

  1. Better usability with no security cost
  2. Mandatory compliance with GB/T 39412 log-security goals
  3. Information disclosure that helps attackers map frameworks, paths, and query details Correct answer.
  4. Automatic repair of SQL injection

Explanation

Verbose errors are an information-disclosure defect. Log details internally with correlation IDs; show generic messages to users. GB/T 39412 log security is about protecting logs, not dumping stacks to browsers.

Question 21Application and data protection

A TOCTOU (time-of-check to time-of-use) race typically occurs when:

  1. Code checks a file or permission, then later uses the same path while an attacker can change the target in between Correct answer.
  2. A compiler prints two warnings on the same line
  3. Two designers choose different fonts
  4. A unit test runs in under one millisecond

Explanation

TOCTOU is a concurrency/file-system defect: the checked object is not the used object. Prefer atomic operations, descriptors rather than paths, and locks. CISAW multithreading and file topics include this class.

Question 22Application and data protection

Passing untrusted input as the format string to printf-style functions is dangerous because:

  1. Format specifiers can read or write memory the programmer did not intend Correct answer.
  2. Printf always encrypts its arguments
  3. Format strings are required by CSRF tokens
  4. GB/T 39412 mandates user-controlled format strings

Explanation

Format-string bugs are a C/C++ implementation defect. Keep the format literal in the code and pass user data as arguments. No exploit payload is needed to understand the class.

Question 23Application and data protection

Use-after-free occurs when software:

  1. Allocates an object and never uses it
  2. Continues to use a pointer after the memory has been freed, leading to corruption or unexpected control flow Correct answer.
  3. Calls free() twice on a NULL pointer in every language
  4. Uses a garbage-collected language’s collector as a cryptographic RNG

Explanation

After free, the memory may be reused; dangling pointers are a C/C++ memory-safety defect in CISAW’s pointer and resource topics. Mitigations include nulling pointers, safer allocators, and memory-safe languages where appropriate.

Question 24Application and data protection

Mass assignment (over-posting) happens when an API:

  1. Binds all incoming fields onto an internal object, allowing clients to set privileged properties such as role or price Correct answer.
  2. Uses parameterized queries for every field
  3. Rejects unknown JSON keys by default
  4. Stores passwords only as salted hashes

Explanation

If a framework maps request fields straight onto a model, attackers can set isAdmin or balance. Define explicit allowlists of bindable fields. This is an authorization/input-validation coding defect.

Question 25Application and data protection

An open redirect is risky mainly because it can be used to:

  1. Speed up TLS handshakes
  2. Force the database to use parameterized queries
  3. Implement HttpOnly cookies
  4. Send users from a trusted domain to an attacker-controlled site after login or in phishing Correct answer.

Explanation

If next= is an unvalidated URL, a trusted site can bounce victims to a look-alike. Allowlist internal paths, or use server-side redirect IDs rather than raw external URLs.

Question 26Application and data protection

A page HTML-encodes a search term in the body, but client-side script later writes location.hash into innerHTML. What defect remains?

  1. DOM-based XSS, because the sink is in browser script and server HTML encoding of the body does not cover that path Correct answer.
  2. SQL injection in the hash fragment
  3. A CSRF token automatically sanitizes innerHTML
  4. Hash fragments cannot be read by JavaScript

Explanation

DOM XSS uses a client-side source (hash, fragment, local storage) and a dangerous sink (innerHTML, eval). Server-side encoding of a different parameter does not protect that sink. Use safe DOM APIs and encode for JavaScript/HTML context.

Question 27Application and data protection

Why does a correct anti-CSRF token not stop a stored XSS attack on the same origin?

  1. CSRF tokens expire every millisecond, so XSS cannot run
  2. Script running in the victim’s origin can read the page and submit the token itself, so XSS bypasses CSRF defenses Correct answer.
  3. HttpOnly cookies cannot be sent by the browser after XSS
  4. XSS and CSRF are the same CWE and one control always covers both

Explanation

CSRF assumes the attacker cannot read the response. Same-origin script can. XSS therefore undermines CSRF tokens and can also steal non-HttpOnly cookies. Fix XSS separately with encoding, CSP, and cookie flags.

Question 28Application and data protection

Reusing the same nonce/IV with the same key in AES-GCM is a serious misuse because:

  1. GCM then provides stronger integrity than intended
  2. Nonces are ignored in GCM so reuse is required
  3. Nonce reuse can allow forgery and compromise of authenticity (and in severe cases keystream recovery) for that key Correct answer.
  4. GB/T 18336 requires nonce reuse for trusted path

Explanation

Authenticated encryption modes such as GCM require unique nonces per key. Reuse is a high-impact crypto bug. Use a CSPRNG or a counter that never repeats, or a nonce-misuse-resistant design.

Question 29Application and data protection

A login function compares password hashes with an early-exit byte-by-byte equality that returns on the first mismatch. What is the security concern?

  1. Attackers may use timing differences to recover the secret, so a constant-time comparison should be used Correct answer.
  2. Early-exit comparison encrypts the password
  3. Timing is never observable on any network
  4. CISAW requires early-exit compares as a denial-of-service control

Explanation

Non-constant-time compares can leak matching prefix length. Use the crypto library’s fixed-time equality. This is a subtle coding defect in authentication modules.

Question 30Application and data protection

A team says “we use stored procedures, so SQL injection is impossible.” When is that claim false?

  1. Stored procedures never accept parameters, so they cannot be injected
  2. If the procedure or caller still concatenates untrusted strings into dynamic SQL inside the procedure or in ad-hoc statements Correct answer.
  3. If the database product logo includes the word “secure”
  4. If TLS is enabled on the client browser

Explanation

Stored procedures help when they use bound parameters. Dynamic SQL built from strings inside a procedure is still injection. Parameterization of every query, including inside routines, is the real control.

Question 31Secure development, review and software supply chain

What is the main difference between a conventional SDLC and an SSDLC?

  1. An SSDLC forbids agile methods and requires a pure waterfall schedule
  2. An SSDLC is only a Chinese GB/T document number and is not a development process
  3. An SSDLC adds security activities throughout requirements, design, implementation, verification, release, and response instead of treating security as a late testing add-on Correct answer.
  4. An SSDLC replaces functional testing with penetration testing only

Explanation

A secure software development life cycle (SSDLC) weaves security work into every phase rather than waiting for a final scan. CISAW Secure Software training contrasts ordinary development models with security-aware models so defects are prevented earlier.

Question 32Secure development, review and software supply chain

When should security requirements first be identified in an SSDLC?

  1. Only in the final week of system testing
  2. Only when a customer requests a penetration test
  3. Only after the first production incident
  4. During requirements and planning, before detailed design and coding Correct answer.

Explanation

Security requirements belong in the requirements phase so design, coding, and tests can implement them. Identifying them only after incidents or at the end of testing is the opposite of shift-left SSDLC practice taught in CISAW Secure Software.

Question 33Secure development, review and software supply chain

Which statement best describes a security requirement as opposed to an ordinary functional requirement?

  1. It only lists screen layouts and color themes
  2. It only describes batch job run times
  3. It states a needed security property such as authentication, authorization, confidentiality, integrity, or auditability Correct answer.
  4. It is always identical to a performance SLA

Explanation

Security requirements specify how the software must protect assets and users: who is identified, what is authorized, what is logged, and how data is protected. Functional features may still need security constraints, but a color theme or a runtime SLA is not itself a security requirement.

Question 34Secure development, review and software supply chain

In software security, the CIA triad refers to:

  1. Coding, integration, and acceptance testing only
  2. Cost, inventory, and accounting controls only
  3. Customer, integrator, and auditor roles only
  4. Confidentiality, integrity, and availability Correct answer.

Explanation

CIA is confidentiality, integrity, and availability. CISAW software-security work still uses this triad when writing requirements and selecting controls, often adding authenticity, non-repudiation, and privacy.

Question 35Secure development, review and software supply chain

What does “shift left” mean in secure development?

  1. Delay code review until after public release
  2. Replace developers with a single security scanner
  3. Move security analysis, requirements, and testing earlier so defects are cheaper to fix Correct answer.
  4. Move all security work to the production operations team

Explanation

Shift left means doing threat modeling, secure requirements, coding standards, and automated checks earlier in the life cycle. Later fixes cost more and may require design changes that a last-minute scan cannot provide.

Question 36Secure development, review and software supply chain

A team using agile two-week sprints asks how to apply SSDLC. Which approach is most consistent with secure agile practice?

  1. Forbid automated tests because agile only values working software demos
  2. Document security only in a binder that developers never see
  3. Skip security until a yearly waterfall hardening project
  4. Add small security stories, threat-model changes, and automated checks inside each sprint rather than one isolated security phase Correct answer.

Explanation

Agile SSDLC spreads security work across sprints: backlog security stories, lightweight threat modeling of changed flows, coding standards, and pipeline checks. CISAW covers multiple development models; agile still needs continuous security, not a yearly bolt-on.

Question 37Secure development, review and software supply chain

What is the purpose of a security gate between SSDLC phases?

  1. To guarantee that no future vulnerability can ever appear
  2. To replace all functional quality reviews
  3. To require evidence that agreed security activities were completed before the work proceeds Correct answer.
  4. To delay release until marketing approves the logo

Explanation

A security gate is a go/no-go check: threat model updated, high-severity findings treated, required reviews or tests done. It does not prove the software is forever invulnerable, but it stops silent skipping of security work.

Question 38Secure development, review and software supply chain

How do abuse cases (misuse cases) help security requirements?

  1. They replace all threat modeling diagrams
  2. They are used only to estimate advertising click-through rates
  3. They list only happy-path shopping-cart steps
  4. They describe how an attacker or misuser might abuse functions so controls and tests can be specified Correct answer.

Explanation

Abuse or misuse cases invert use cases: they ask how login, upload, or payment could be abused. That drives authentication, authorization, validation, and logging requirements and later negative tests.

Question 39Secure development, review and software supply chain

Microsoft SDL is a typical secure-development model taught alongside others in CISAW Secure Software. Which set of activities matches that style of model?

  1. Only rewriting the GUI theme each year
  2. Only counting lines of code as a security metric
  3. Security training, requirements, threat-informed design, secure implementation, verification, release, and response Correct answer.
  4. Only network firewall purchase after go-live

Explanation

Classic Microsoft SDL organizes security training, requirements, design (including threat modeling), implementation, verification, release, and incident response. CISAW expects candidates to recognize such end-to-end models rather than a single post-production control.

Question 40Secure development, review and software supply chain

What is the most useful role of a security champion on a software team?

  1. To approve every marketing screenshot
  2. To be the only person allowed to write application code
  3. To coach the team on standards, reviews, and tools so security is not isolated in a distant team Correct answer.
  4. To disable all logging to improve performance

Explanation

A security champion is a developer or tester who spreads secure-coding practice, helps with reviews, and connects the team to specialists. SSDLC fails if security knowledge lives only in a remote group that never sees the code.

Question 41Secure development, review and software supply chain

Why should security requirements be traced to design, code, and tests?

  1. Traceability replaces the need for authentication
  2. Traceability is only a hardware manufacturing barcode
  3. Traceability proves that each required control was designed, implemented, and verified rather than lost between documents Correct answer.
  4. Traceability is only needed for counting story points

Explanation

Requirements traceability links a control such as “session timeout” to design, code, and a test case. CISAW-style SSDLC uses this so security work is not dropped when schedules slip.

Question 42Secure development, review and software supply chain

Why does SSDLC emphasize finding defects in requirements and design rather than only in late testing?

  1. Late testing is illegal in China
  2. Compilers refuse to run until a threat model exists
  3. Requirements and design defects are typically cheaper and less disruptive to fix than the same issues found after coding or release Correct answer.
  4. Users prefer products with more production emergencies

Explanation

Industry SSDLC teaching, including CISAW, stresses that the later a defect is found, the more code, tests, and deployments must change. Early threat modeling and requirements review reduce that cost.

Question 43Secure development, review and software supply chain

A product owner wants to mark a user story “done” after the feature demo. From an SSDLC view, when is the story actually done?

  1. When the demo video is uploaded, regardless of tests
  2. When the feature is coded, even if authorization checks are missing
  3. When agreed functional tests pass and the story’s security criteria (validation, access control, logging, secret handling) are met Correct answer.
  4. When a manager says the sprint chart looks green

Explanation

Definition of done in SSDLC includes the security acceptance criteria for that story, not only a UI demo. Shipping without validation, access control, or safe secret handling creates security debt.

Question 44Secure development, review and software supply chain

Why do mature SSDLC models include a response or maintenance phase after release?

  1. Because response work replaces the need for secure coding
  2. Because CISAW forbids monitoring after go-live
  3. Because released software never needs patches
  4. Because vulnerability reports, dependency alerts, and incidents must be triaged, fixed, and used to improve the process Correct answer.

Explanation

Release is not the end of software security. Coordinated vulnerability handling, patching, and lessons learned feed the next development cycle. CISAW’s software-security management and vulnerability-management topics cover this loop.

Question 45Secure development, review and software supply chain

Why do models such as Microsoft SDL start with developer security training?

  1. Training is a substitute for code review and testing
  2. Only project managers need security knowledge
  3. Compilers automatically teach secure coding
  4. People who write and review code must recognize common defect classes before tools and gates can be effective Correct answer.

Explanation

Training is the first SDL-style practice because developers and reviewers must know injection, crypto misuse, and secrets handling. Tools still miss logic and design flaws, so untrained teams will not use gates well.

Question 46Secure development, review and software supply chain

Where should privacy and personal-information protection requirements be handled in an SSDLC for a Chinese software product?

  1. Only inside the database backup password
  2. Privacy never applies if the app uses HTTPS
  3. Only in a marketing privacy slogan after release
  4. As first-class requirements and design constraints, aligned with PIPL and related GB/T personal-information rules, not as an optional afterthought Correct answer.

Explanation

CISAW security-function design includes privacy protection. For software that processes personal information in China, minimization, purpose limitation, access control, and user rights must be specified and designed, not added as a slogan. HTTPS is necessary transport protection, not a complete privacy program.

Question 47Secure development, review and software supply chain

A medical-device team writes “the infusion pump shall continue delivering the last valid rate if the network drops.” A security engineer writes “the pump shall reject unauthenticated remote rate changes.” How should SSDLC treat these?

  1. Security requirements always override safety, so the pump should halt on any network error
  2. Neither belongs in software requirements
  3. The first is a safety/availability requirement and the second is a security (authentication) requirement; both must be specified and checked for conflict Correct answer.
  4. They are duplicates, so only the network-drop statement is kept

Explanation

Safety (do no harm, fail to a clinically acceptable state) and security (authenticate and authorize commands) interact. SSDLC must capture both and analyze conflicts: rejecting forged commands must not create an unsafe fail-open or fail-closed behavior that the safety case forbids.

Question 48Secure development, review and software supply chain

CISAW Secure Software training asks candidates to master a CISAW software-security development model after reviewing typical SDLC and SSDLC models. What is the sound exam approach if a question names that CISAW model?

  1. Assume it is identical to ITIL service operation only
  2. Assume it is only a network zoning diagram
  3. Treat it as an SSDLC: security activities mapped onto development phases, not a claim that CISAW invented unique secret phase names Correct answer.
  4. Treat it as a ban on code review

Explanation

The published CISAW outline lists typical development models plus a CISAW software-security development model. Public notices do not freeze a unique official phase list in English, so the examinable idea is SSDLC structure: security in requirements, design, coding, testing, release, and management-not invented trademarked step names.

Question 49Secure development, review and software supply chain

An agile team says threat modeling “takes too long for a two-week sprint.” Which practice still satisfies SSDLC without a separate multi-week security phase?

  1. Run a single pentest five years after launch
  2. Store all threat notes only in a personal chat that is deleted
  3. Threat-model only the changed data flows and new trust-boundary crossings in the sprint, and carry residual risks in the backlog Correct answer.
  4. Delete authentication from the product to save time

Explanation

Agile threat modeling is incremental: update the model for what changed, record assumptions and residual risk, and add mitigation stories. That keeps STRIDE-style analysis alive without pretending every sprint needs a full-system workshop.

Question 50Secure development, review and software supply chain

A release manager wants to ship with an unfixed high-severity SAST finding because of a contractual date. What is the SSDLC-aligned decision process?

  1. Always ship with no record because dates always beat risk
  2. Always delete the finding from the tracker so auditors see a clean report
  3. Always cancel the company rather than slip a date
  4. Document the residual risk, owner, expiry, and compensating control; obtain the named risk-acceptance authority; and schedule the fix - do not silently waive it Correct answer.

Explanation

SSDLC allows documented, time-bounded risk acceptance by an authorized owner, not silent suppression. CISAW software-security management expects vulnerability handling, accountability, and follow-up rather than hiding scanner output.