I85PREP
⌘ K
CISP-SSDP study materials
CISP-SSDP study resources

CISP-SSDP practice questions

One question at a time. Build your CISP-SSDP understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application and data protection

What is the usual root cause of SQL injection in web applications, at the level CISP-SSDP practice items test?

  1. Enabling TLS on the load balancer
  2. Using parameterized queries for all untrusted input
  3. Building SQL statements by concatenating untrusted input instead of using bound parameters or a safe ORM mapping Correct answer.
  4. Storing hashes of passwords

Explanation

SQL injection happens when untrusted input is interpreted as SQL. The practice domain expects you to recognize concatenation as the defect and parameterization or ORM mapping as the code-level fix. Password hashing and TLS are good controls for other risks, not this one.

Question 2Application and data protection

Which defense is the primary code-level control for XSS in the CISP-SSDP practice outline?

  1. Store the raw script in the database so it is easier to replay
  2. Turn off authentication
  3. Disable all HTTP
  4. Validate input and encode output for the destination context (for example HTML entity encoding), optionally adding CSP as defense in depth Correct answer.

Explanation

The outline's XSS practice item is input validation (including allowlists), output encoding such as HTML entity encoding, and CSP. Encoding must match the context where data will be interpreted. Storing or reflecting unencoded active content is the defect.

Question 3Application and data protection

Which combination is the CISP-SSDP-listed CSRF defense set?

  1. Anti-CSRF tokens, SameSite cookie attributes, and Referer checking, used together rather than as a single silver bullet Correct answer.
  2. Disabling HTTPS
  3. Sharing session cookies on a public wiki
  4. Only a wider login button

Explanation

The CSRF practice subdomain lists token mechanisms, SameSite cookies, and Referer checks. Tokens are the usual primary control; SameSite and Referer checks are complementary and incomplete alone. Publishing session cookies or dropping HTTPS makes CSRF and session theft worse.

Question 4Application and data protection

An API returns another customer's order when the caller changes a numeric order ID in the URL. Which defect class is that?

  1. A hardware thermal failure
  2. Insecure direct object reference (IDOR) / missing object-level authorization Correct answer.
  3. Correct least-privilege design
  4. A successful CSRF token implementation

Explanation

If an identifier in the request is enough to read another user's object, the service is not checking whether the caller is authorized for that object. That is IDOR, which the outline groups with vertical and horizontal privilege-escalation practice. The fix is an authorization check before every object access.

Question 5Application and data protection

Which set of controls matches the outline's weak-password and brute-force practice item?

  1. Disable logging of authentication failures
  2. Allow any one-character password, never lock accounts, and store passwords in plaintext
  3. Enforce password complexity, store salted hashes, apply login rate-limiting and lockout, and add MFA Correct answer.
  4. Email the current password to any address that types a username

Explanation

The practice item lists complexity requirements, salted hashes, login rate limits and lockout, and MFA. Plaintext, no lockout, password emailing, and no failure logs are how credential-stuffing succeeds.

Question 6Application and data protection

Backup files, default credentials, and directory listing on a web server most directly enable which practice-domain issue?

  1. Hardware-secure boot
  2. Mandatory access control on a sealed HSM
  3. Perfect forward secrecy of TLS 1.3
  4. Sensitive-information disclosure through unsafe configuration Correct answer.

Explanation

The outline's information-disclosure practice item is exactly leftover files, default configuration, and directory listing exposing configs, logs, or backups. Hardening, deleting leftovers, and correct permissions are the listed defenses.

Question 7Application and data protection

A SCA tool reports a known-high CVE in a third-party library used by the app. Which response matches the practice outline?

  1. Upgrade or replace the component, or disable the unsafe function and apply the vendor patch, then verify Correct answer.
  2. Copy the vulnerable class into your tree so the CVE ID disappears from SCA
  3. Publish the production database to prove impact
  4. Ignore it because the library is popular

Explanation

The component-security practice item is to upgrade, disable unsafe features, or patch, which matches the vulnerability-management lifecycle's remediate-and-verify steps. Hiding the identity of the code or dumping production data is not remediation.

Question 8Application and data protection

How should stored XSS and reflected XSS be distinguished for CISP-SSDP practice?

  1. They are identical in persistence; only the logo differs
  2. Stored XSS persists malicious content and later serves it to other users; reflected XSS is returned in the immediate response to a crafted request Correct answer.
  3. Reflected XSS only affects database backups
  4. Stored XSS can occur only in desktop applications with no HTTP

Explanation

The outline asks candidates to understand stored versus reflected XSS. Stored XSS is persisted (for example in a comment) and hits later viewers. Reflected XSS is echoed in the response to a crafted request. Both need context-correct encoding; stored XSS often has broader blast radius.

Question 9Application and data protection

Why is SameSite cookie configuration listed next to CSRF tokens in the outline?

  1. SameSite disables all cookies including the user's shopping cart on first-party pages
  2. SameSite makes databases faster
  3. SameSite restricts when browsers attach cookies on cross-site requests, reducing CSRF, but it is not a complete replacement for anti-CSRF tokens on sensitive actions Correct answer.
  4. SameSite encrypts the cookie payload with a public wiki key

Explanation

SameSite tells the browser when to send cookies on cross-site requests, which cuts off many CSRF patterns. Tokens still bind user intent on state-changing requests, which is why the outline lists both. SameSite is not encryption and should not break all first-party sessions if configured correctly.

Question 10Application and data protection

Which file-upload control set matches the CISP-SSDP practice item?

  1. Execute every upload immediately to 'see if it works'
  2. Disable authentication on the upload route to simplify testing
  3. Trust the filename extension only and store uploads inside the web-executable directory
  4. Check declared type and file header/content, limit size, store outside the executable web path, and deny execute permission Correct answer.

Explanation

The outline's upload defenses are type checks (including content/header, not just names), size limits, isolated storage, and no execute permission. Executable storage plus extension-only checks is how upload becomes remote code execution. This bank does not teach how to craft such files.

Question 11Application and data protection

Which code-level approach matches the outline's command-injection defense practice?

  1. Prefer not to invoke a shell; if an external command is required, allowlist arguments, avoid concatenation into a shell, and run it with least privilege Correct answer.
  2. Run the application as root so the command always succeeds
  3. Log the full command line including secrets to the public UI
  4. Pass raw user strings to a shell interpreter whenever it seems convenient

Explanation

Command injection happens when untrusted data is interpreted by a shell. The outline's defenses are input filtering/allowlists and least-privilege execution, plus avoiding unsafe concatenation. Root and public command logs increase impact and disclosure.

Question 12Application and data protection

How should NoSQL or LDAP injection be prevented at the same conceptual level as SQL injection?

  1. Assume non-relational stores ignore all untrusted input by magic
  2. Use parameterized APIs or strict input validation so untrusted data cannot change query semantics Correct answer.
  3. Disable authentication on directory services
  4. Print directory bind credentials in client-side JavaScript

Explanation

The outline groups LDAP/NoSQL injection with other injection classes: untrusted input must not become query operators. Parameterized APIs and validation are the transferable control. Directory credentials in JavaScript or open binds create additional compromise paths.

Question 13Application and data protection

Which pair correctly distinguishes vertical and horizontal privilege escalation in the IDOR practice item?

  1. Vertical: using TLS; horizontal: using IPv6
  2. They are marketing terms with no technical meaning
  3. Vertical: a user reaches a higher privilege role; horizontal: a user reaches another user at the same role Correct answer.
  4. Vertical: changing CSS; horizontal: changing fonts

Explanation

Vertical escalation is gaining a higher privilege (user to admin). Horizontal escalation is accessing another principal's resources at the same privilege (user A reads user B). Both are authorization failures; IDOR is a common horizontal form.

Question 14Application and data protection

In API security practice, what is the difference between BOLA and BFLA?

  1. They both mean the TLS version is too new
  2. BOLA only applies to printers
  3. BOLA is a logging format; BFLA is a font
  4. BOLA is broken object-level authorization (accessing another object's record); BFLA is broken function-level authorization (calling an operation the role must not have) Correct answer.

Explanation

The outline names Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) as API-specific privilege issues. BOLA is 'wrong object'; BFLA is 'wrong operation/role.' Microservices and API gateways still need fine-grained checks on every request.

Question 15Application and data protection

Which SSRF defense set matches the CISP-SSDP practice outline?

  1. Allowlist destinations, disable unsafe redirects, restrict protocols and ports, and tightly control URL parsing Correct answer.
  2. Follow every redirect across schemes to be 'helpful'
  3. Pass the raw URL to a shell so the OS resolver can 'handle it'
  4. Fetch any URL the client supplies, including link-local cloud metadata addresses

Explanation

SSRF is the server fetching a resource the attacker chooses, which can reach internal networks or metadata services. The outline's defenses are URL allowlists, no unsafe redirects, protocol/port restrictions, and strict parsing. This bank does not provide payloads; it tests whether you pick those controls.

Question 16Application and data protection

Which approach is the sound CISP-SSDP defense against insecure deserialization?

  1. Deserialize any blob from the Internet using native native loaders
  2. Avoid untrusted deserialization; prefer allowlisted types or formats, use safe libraries, and integrity-check (for example sign) serialized data Correct answer.
  3. Enable Java or Python native loaders on every public endpoint for convenience
  4. Log deserialized objects including session secrets to a public debug page

Explanation

The outline treats unsafe deserialization as a path to severe impact, including remote code execution in some language ecosystems. The listed defenses are allowlists, safe libraries, and signature checks on serialized data. Public native loaders and debug dumps are how the defect is exploited or amplified. No exploit recipe is required to choose the control.

Question 17Application and data protection

A promo-code endpoint sometimes grants two discounts when two requests arrive together. Which business-logic issue and defense does the outline point to?

  1. A missing favicon
  2. A CSS race; fix it with a new font
  3. A race condition; use locking, transactions, or uniqueness constraints so the check-and-use cannot double-apply Correct answer.
  4. A TLS downgrade; disable HTTPS

Explanation

The outline's business-logic practice item uses race conditions that bypass limits or repeat operations. Defenses are locking, transactions, and uniqueness constraints so two concurrent requests cannot both pass a 'not yet used' check.

Question 18Application and data protection

Hard-coded encryption keys in a mobile client and plaintext storage of tokens most directly illustrate which practice item?

  1. A well-implemented HSM design
  2. Mandatory hardware-backed attestation
  3. Correct key management with a KMS
  4. Cryptographic failure and sensitive-data exposure Correct answer.

Explanation

The outline's crypto-failure practice item is weak algorithms, hard-coded keys, and plaintext transmission or storage. The matching defenses are strong algorithms, real key management, HTTPS, and masking/filtering of sensitive fields. Client-embedded keys are recoverable by anyone who can inspect the app.

Question 19Application and data protection

Why does the outline treat incomplete security logging as part of an attack chain?

  1. Because missing records of sensitive actions, abnormal logins, and failures let an attacker move without being reconstructed later Correct answer.
  2. Because logs replace access control
  3. Because SIEM forbids application logs
  4. Because extra logs always crash the CPU

Explanation

The logging-and-monitoring practice item is that incomplete logs hide attacker movement. The expected content includes sensitive operations, abnormal logins, and error information, feeding later analysis. Logs do not replace authorization, and SIEM depends on those events.

Question 20Application and data protection

Where does Content Security Policy (CSP) fit among XSS defenses in CISP-SSDP practice?

  1. CSP is the only control needed; encoding is obsolete
  2. CSP is a defense-in-depth browser policy that limits where scripts may run, used with validation and output encoding rather than instead of them Correct answer.
  3. CSP encrypts the database at rest
  4. CSP disables all cookies including first-party sessions

Explanation

The XSS practice list is validation, output encoding, and CSP. CSP is a browser-enforced policy that reduces the impact of injected script. It does not encrypt data stores and it does not replace encoding, because not all browsers or contexts honor a policy equally.

Question 21Application and data protection

Which description matches the outline's SAST-tool practice examples?

  1. SAST tools issue driver's licenses
  2. SAST tools only ping IP addresses
  3. Tools such as SonarQube Community Edition or Bandit for Python statically analyze a codebase so reviewers can read findings, separate true issues from noise, and propose fixes Correct answer.
  4. SAST tools deploy Kubernetes clusters

Explanation

The practice chapter names SonarQube Community and Bandit as example SAST tools used to scan a target tree, interpret reports, distinguish true positives, and recommend repairs. That is report literacy, not exploit writing.

Question 22Application and data protection

Which description matches the outline's DAST-tool practice examples?

  1. Using a word processor to change the font of requirements
  2. Using a packet radiator to jam Wi-Fi as a default test
  3. Using production ransomware in an unauthorized environment
  4. Using OWASP ZAP or Burp Suite Community to dynamically scan a running web app and perform basic authorized manual probing that simulates attacker behavior Correct answer.

Explanation

The outline names OWASP ZAP and Burp Suite Community as DAST-style tools for scanning a live target and doing basic authorized manual testing. Unauthorized jamming or ransomware is illegal and unethical, and it is not what the practice item teaches.

Question 23Application and data protection

What should an SCA tool such as OWASP Dependency-Check be used for in CISP-SSDP practice?

  1. To analyze project dependencies, support SBOM generation, identify known component CVEs, and recommend upgrades or replacements Correct answer.
  2. To replace unit tests of business math
  3. To compile C to WebAssembly
  4. To paint architecture diagrams

Explanation

The SCA practice item is dependency analysis, SBOM generation, CVE identification, and upgrade/replacement advice. It does not replace functional unit tests or act as a compiler.

Question 24Application and data protection

How does the outline describe CI/CD security integration in products such as Jenkins, GitLab, or GitHub?

  1. Security tools must only run on an intern's laptop after release
  2. SAST, IAST, DAST, and SCA should run in the pipeline, with scan results used as build quality gates in a DevSecOps flow Correct answer.
  3. Quality gates should always be skipped on Fridays
  4. Pipelines should store production passwords in job names

Explanation

The CI/CD practice subdomain is to implement SAST, IAST, DAST, and SCA in Jenkins/GitLab/GitHub-style pipelines and to treat results as quality gates. Skipping gates or putting passwords in job names undoes the control.

Question 25Application and data protection

When defending SQL injection, how do parameterized queries and ORM mapping relate?

  1. Parameterized queries only work if you also disable TLS
  2. Both require storing the database root password in the browser
  3. They are two named ways to avoid concatenating untrusted data into SQL, provided the ORM is not bypassed with raw strings Correct answer.
  4. ORM mapping makes parameterization illegal

Explanation

The SQL-injection practice item lists parameterized queries and ORM mapping as the code-level alternatives to string-built SQL. An ORM still fails if developers drop back to concatenated raw SQL. Neither control involves putting DBA passwords in browsers or turning off TLS.

Question 26Application and data protection

Why is Referer checking listed as a CSRF control but not sufficient by itself?

  1. Because Referer checking encrypts POST bodies
  2. Because Referer checking replaces authorization of the user
  3. Because Referer headers are always cryptographically signed by browsers
  4. Because some clients omit or forge Referer, so tokens and SameSite still belong in the design Correct answer.

Explanation

Referer checks can reject many cross-site requests, which is why the outline lists them. They are brittle: privacy settings, proxies, and some clients suppress or alter Referer. Anti-CSRF tokens bind intent more reliably, and SameSite reduces cookie attachment. None of these replaces object-level authorization.

Question 27Application and data protection

A pipeline reports: (1) a first-party hardcoded AWS key, (2) a known CVE in log4j-class logging library, (3) an access-control bypass only on the deployed staging URL. Which tool-to-finding map is correct?

  1. SAST for the hardcoded key, SCA for the known library CVE, DAST for the deployed access-control bypass Correct answer.
  2. DAST for the hardcoded key in source, RASP for the library inventory
  3. Fuzzing for license SPDX identifiers
  4. SCA for the hardcoded key, SAST for the CVE, IAST for TLS certificates

Explanation

Hardcoded keys are in source (SAST). Known library CVEs are SCA's job. An access-control bypass that appears only on a deployed URL is DAST (or a live config review). Mixing those assignments is the usual wrong-tool trap on this exam.

Question 28Application and data protection

A feature lets users supply a URL that the server fetches to generate a link preview. Which CISP-SSDP judgment is correct?

  1. This pattern is always safe because the server, not the user, performs the fetch
  2. This is a classic SSRF-prone design; apply destination allowlists, protocol/port restrictions, redirect controls, and block link-local/metadata ranges rather than fetching arbitrary client URLs Correct answer.
  3. The correct fix is to disable all logging
  4. The correct fix is to run the fetcher as root on the hypervisor

Explanation

Server-side fetches of client-supplied URLs are the SSRF pattern in the practice outline. Safety comes from constraining where the server may connect, not from the fact that the server is the HTTP client. Root hypervisors and log deletion worsen impact and forensics. No exploit payload is needed to choose the control.

Question 29Application and data protection

Automated SAST and DAST are clean, but a user can still apply an expired coupon by repeating a request. What should a CISP-SSDP candidate conclude?

  1. The correct response is to disable all authentication
  2. The scanners have proved the application has no security issues
  3. This is a business-logic/race-class issue that automated scanners often miss; add authorization and atomicity controls, and consider authorized pentest/manual review Correct answer.
  4. Expired coupons are a CSS problem

Explanation

The outline repeatedly states that automated tools miss business-logic defects and that pentest plus SSDLC feedback remain necessary. A repeated expired-coupon success is a logic/atomicity failure, not a CSS bug. Disabling authentication would add a new defect class.

Question 30Application and data protection

A team wants CI/CD security gates but is afraid of blocking releases. Which policy is consistent with CISP-SSDP DevSecOps practice?

  1. Store production secrets in the job title so on-call can see them
  2. Let unsigned community scripts overwrite the compiler on the runner
  3. Fail open on critical SAST/SCA findings so marketing dates always win
  4. Fail closed on high/critical verified findings, with a documented exception path, while still running SAST, DAST/IAST, and SCA as gates rather than as ignored dashboards Correct answer.

Explanation

Quality gates that never fail are not controls. The outline's CI/CD practice is to run SAST, IAST, DAST, and SCA and to use results as build gates. A documented exception path preserves emergency delivery without making every critical finding informational. Secrets in job titles and untrusted runner scripts attack the pipeline itself.

Question 31Secure development, review and software supply chain

Which sources does the CISP-SSDP outline expect teams to use when capturing security requirements?

  1. Business needs, user cases, historical vulnerabilities, threat intelligence, and compliance requirements Correct answer.
  2. Only the CEO's password length preference
  3. Only leftover comments in archived tickets
  4. Only the marketing slogan on the product box

Explanation

The outline says security requirements should be identified from multiple sources: business needs, user cases, historical vulnerabilities, threat intelligence, and compliance. A single informal preference is not a requirements process. Multi-source capture is what later feeds threat modeling and testable security user stories.

Question 32Secure development, review and software supply chain

In CISP-SSDP security-requirements analysis, how should functional and non-functional security requirements be treated?

  1. They are the same thing and need not be distinguished
  2. They should be distinguished and then prioritized by risk level and business importance Correct answer.
  3. Non-functional security requirements are always optional comments
  4. Functional security requirements are only GUI color rules

Explanation

The outline requires distinguishing functional security requirements (security features the system must provide) from non-functional ones (qualities such as resistance to specified attacks) and then prioritizing them by risk and business importance. That ranking drives what gets designed, coded, and tested first.

Question 33Secure development, review and software supply chain

Which statement best expresses the least-privilege principle as used in CISP-SSDP secure architecture?

  1. Guest users should inherit developer keys from the CI system
  2. Every account should be a domain administrator so support is faster
  3. Users and processes should receive only the minimum permissions needed to perform their legitimate functions Correct answer.
  4. Permissions should be copied from the most privileged role to save design time

Explanation

Least privilege (最小权限) is one of the architecture principles the outline requires candidates to apply: grant only the access needed for the job. Over-privileged accounts and reused developer secrets expand blast radius after compromise.

Question 34Secure development, review and software supply chain

What does defense in depth (纵深防御) require in software architecture?

  1. Disabling logging so attackers have fewer layers to study
  2. Relying only on a marketing claim of 'military-grade encryption'
  3. A single perimeter control that is assumed never to fail
  4. Layered complementary controls so that one missed control does not by itself cause total compromise Correct answer.

Explanation

Defense in depth means combining isolation, modularization, reduced attack surface, least privilege, and other controls so no single failure is fatal. The outline lists 纵深防御 among the architecture principles that should be practiced, not merely named.

Question 35Secure development, review and software supply chain

What is the defining characteristic of SAST in the CISP-SSDP testing knowledge body?

  1. It analyzes source or bytecode without executing the program, finding defects during coding, but it cannot see many runtime or business-logic flaws Correct answer.
  2. It replaces the need for any running-environment test
  3. It only enumerates open TCP ports on the firewall
  4. It only fuzzes network packets against a production cluster

Explanation

SAST (static application security testing) inspects code without running it, so it can catch issues such as hardcoded credentials or weak crypto early. The outline also requires knowing its limits: it misses many runtime and business-logic issues, which is why DAST, IAST, and manual review still matter.

Question 36Secure development, review and software supply chain

What can DAST do that SAST typically cannot?

  1. Prove that every source line is unreachable
  2. Exercise a running application the way an attacker would and surface configuration, deployment, and some business-logic issues Correct answer.
  3. Rewrite the compiler to insert memory-safe types
  4. Issue a software license for third-party libraries

Explanation

DAST tests a running application and therefore can see misconfiguration, deployment mistakes, and some logic issues that never appear in static code. Its limitation, also in the outline, is incomplete path coverage. SAST and DAST are complementary, not substitutes.

Question 37Secure development, review and software supply chain

In STRIDE threat modeling as required by CISP-SSDP, which threat is spoofing?

  1. Documenting an API in OpenAPI format
  2. Enabling TLS 1.3 on a load balancer
  3. Pretending to be another user, process, or system, which is primarily countered by authentication Correct answer.
  4. Deleting backups to reduce storage cost

Explanation

STRIDE's S is spoofing: an attacker impersonates an identity. The usual mitigating control is authentication (and related identity-proofing). CISP-SSDP requires candidates to apply STRIDE categories to design, not merely recite the acronym.

Question 38Secure development, review and software supply chain

A threat model notes that an attacker could alter records in transit between the web tier and the database. Which STRIDE category is that, and which control family is the first fit?

  1. Spoofing, addressed by choosing a brighter theme
  2. Elevation of privilege, addressed by adding more public anonymous APIs
  3. Repudiation, addressed only by a wider font in the UI
  4. Tampering, addressed by integrity protections such as authenticated encryption, signatures, or tamper-evident storage Correct answer.

Explanation

Unauthorized modification of data in transit or at rest is tampering (STRIDE T). Integrity controls-MAC/signatures, TLS with integrity, write-protected audit stores-are the matching family. UI cosmetics and extra anonymous APIs do not restore integrity.

Question 39Secure development, review and software supply chain

Which sequence matches the threat-modeling practice steps in the CISP-SSDP outline?

  1. Draw a data-flow diagram, identify threats, assess risk, and design mitigations Correct answer.
  2. Only run a marketing survey of brand colors
  3. Only count lines of code and ship if the count is even
  4. Ship first, then write the privacy policy, then disable logs

Explanation

The outline's threat-modeling steps are: draw a DFD, identify threats, assess risk, and design mitigations. That sequence is what lets STRIDE and similar methods actually change architecture instead of remaining a slide.

Question 40Secure development, review and software supply chain

Which example best matches a CISP-SSDP security user story?

  1. As a user, I want passwords printed in the page footer
  2. As an attacker, I cannot bypass login verification through SQL injection Correct answer.
  3. As a designer, I want the logo to bounce on load
  4. As a vendor, I want all debug ports open in production

Explanation

The outline's own example of a security user story is turning an abstract requirement into a testable statement such as: 'As an attacker, I cannot bypass login verification through SQL injection.' Good security stories are specific, testable, and defensive. The other options are either cosmetic or actively unsafe.

Question 41Secure development, review and software supply chain

A team exposes unused admin APIs, verbose debug endpoints, and extra open cloud security groups 'for convenience.' Which secure-design principle is being violated?

  1. Mandatory use of MD5 for all new passwords
  2. Economy of mechanism only in the documentation footer
  3. Minimize the attack surface (最小化暴露面) Correct answer.
  4. Fail-open logging

Explanation

Minimizing attack surface means removing or tightly restricting unused interfaces, debug endpoints, and overly open network paths. Extra admin APIs and convenience security groups give attackers more ways in. The outline lists 最小化暴露面 among the architecture principles to apply.

Question 42Secure development, review and software supply chain

Which secure-coding approach does the outline require for stopping SQL injection and similar injection flaws?

  1. Disable the database audit log so injection is harder to notice
  2. Print the full SQL exception, including connection strings, to the browser
  3. Concatenate untrusted input into query strings because it is simpler
  4. Use parameterized queries or equivalent bound parameters, plus input validation such as allowlists, and encode output where it will be interpreted Correct answer.

Explanation

CISP-SSDP secure coding requires input validation (allowlists, regex checks) and output encoding, and the practice class adds parameterized queries or ORM mapping so untrusted data is never concatenated as SQL. Revealing exceptions or turning off audit logs makes exploitation and concealment easier.

Question 43Secure development, review and software supply chain

Which password-storage practice matches the CISP-SSDP secure-coding knowledge domain?

  1. Store salted, iterated password hashes and manage keys with a proper key-management process rather than embedding them in source Correct answer.
  2. Store passwords in plaintext so support staff can read them aloud
  3. Reuse one global unsalted hash for every account to save CPU
  4. Store passwords in reversible encryption using a key hard-coded in the client

Explanation

The outline calls for password hashing with salt and iteration, key management (KMS), and encrypted storage of sensitive data. Hard-coded client keys, plaintext, and unsalted global hashes fail confidentiality if the store is leaked.

Question 44Secure development, review and software supply chain

A login API returns 'account exists but password is wrong for user 10001, DB host=10.0.0.8'. Which secure-coding rule is broken?

  1. Error messages must leak enough internals to speed attacker reconnaissance
  2. Error handling must avoid disclosing sensitive system or business information; logs should be structured for audit without exposing those details to users Correct answer.
  3. Every exception should be emailed to all customers
  4. Stack traces should be rendered in the public UI for transparency

Explanation

The outline requires not leaking sensitive system or business data in errors, while still recording structured audit logs (event type, time, user ID, result). User-facing messages should be generic; detailed diagnostics belong in protected logs.

Question 45Secure development, review and software supply chain

A SAST report flags 400 findings. Which handling method matches the CISP-SSDP SAST knowledge subdomain?

  1. Delete the source repository so there is nothing to scan
  2. Ignore the report because SAST never has false positives
  3. Triage true positives versus false positives, prioritize by risk, fix what matters, and tune rules to reduce noise and missed defects Correct answer.
  4. Mark every finding as a false positive without reading it so the pipeline stays green

Explanation

The outline requires analyzing SAST reports, distinguishing true positives from false positives, prioritizing repairs, and understanding why false positives and false negatives occur so rules can be improved. Blind suppression or blind trust both defeat the control.

Question 46Secure development, review and software supply chain

A REST service looks clean in SAST but fails in production because an access-control flag in the deployment config is off. Which testing combination best matches CISP-SSDP guidance?

  1. Disable DAST because it might find issues late
  2. Replace both with a spell-checker
  3. SAST alone, because configuration is never a security issue
  4. Keep SAST for code-level defects and add DAST (and config review) because DAST can see running-environment and some logic/configuration problems SAST cannot Correct answer.

Explanation

The outline contrasts SAST's code-time view with DAST's ability to find configuration, deployment, and some business-logic issues at runtime. A production access-control flag is exactly the class of defect static analysis often misses. Complementary tools are the intended answer, not tool abandonment.

Question 47Secure development, review and software supply chain

Why does the outline treat fuzz testing as valuable for vulnerability discovery?

  1. It feeds large volumes of malformed, unexpected, or random input to find crashes and abnormal handling, including deep or previously unknown defects Correct answer.
  2. It guarantees a complete formal proof of correctness
  3. It replaces threat modeling and code review
  4. It only formats source code

Explanation

Fuzzing (模糊测试) sends malformed or random inputs to trigger crashes and unexpected states. The outline highlights its strength in digging out deep or unknown defects that scripted functional tests may never hit. It does not prove correctness and does not replace design or review.

Question 48Secure development, review and software supply chain

A microservices platform needs user login, API access by third-party apps, and row-level permissions that depend on department and data tags. Which identity design best matches the outline?

  1. Use a single shared 'admin' password in every service configuration file
  2. Separate authentication from authorization; use SSO/OIDC for users, OAuth 2.0 for delegated API access, and ABAC or carefully designed RBAC for authorization-not one mechanism pretending to be all three Correct answer.
  3. Skip authorization if the caller knows any valid username
  4. Store session tokens in unsigned cookies with no expiry

Explanation

The outline requires applying authentication, authorization, session management, SSO, and OAuth 2.0/OIDC, and understanding RBAC versus ABAC. Authentication proves identity; OAuth delegates API access; authorization (RBAC/ABAC) decides what that identity may do. Shared passwords, username-only checks, and unsigned immortal cookies collapse those layers.

Question 49Secure development, review and software supply chain

Which REST versus GraphQL security difference should a CISP-SSDP architect account for?

  1. GraphQL automatically encrypts the database
  2. GraphQL cannot have authorization bugs because queries are text
  3. REST typically exposes discrete endpoints that can be authorized per resource/method, while GraphQL's flexible queries increase the need for field-level authorization, depth/complexity limits, and abuse controls against expensive queries Correct answer.
  4. REST never needs rate limiting

Explanation

The outline asks candidates to understand REST versus GraphQL security differences. GraphQL's single endpoint and client-chosen fields shift risk toward overly broad queries, so field-level authorization and query-cost limits become essential. REST still needs per-method authorization and rate limiting; neither protocol encrypts storage by itself.

Question 50Secure development, review and software supply chain

What is GB/T 38674-2020 in the CISP-SSDP secure-coding domain?

  1. A U.S. export-control form for laptops
  2. An ISO standard that forbids the use of any GB/T document
  3. A food-safety labeling rule unrelated to software
  4. The Chinese national standard 'Information security technology - Guidelines for application software security programming' that frames secure-coding practice Correct answer.

Explanation

GB/T 38674-2020 is named in the outline as the application-software secure-programming guide (信息安全技术 应用软件安全编程指南). Candidates should know it exists as the domestic coding framework, just as they should know GB/T 43848-2024 for open-source code security evaluation. It is not a food, export, or anti-GB/T document.