Software Development Security
16 practice questions with explanations — 15 free to try
PassNova has 16 CISSP practice questions on Software Development Security, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Software Development Security: example questions & answers
2 worked examples with answers and explanations below. Try 15 CISSP questions free in the browser; the full 16-question Software Development Security bank is part of PassNova Premium.
Which secure software development practice involves validating all input on the server side and rejecting data that does not conform to an explicit list of acceptable values?
- AOutput encoding of untrusted data before display
- BAllow-list (whitelist) input validation✓
- CObfuscation of the application's compiled source code
- DCode signing of the deployed application binaries at release
Answer: Allow-list input validation accepts only data matching a predefined set of permitted values, which is more secure than trying to block known-bad input.
A web application allows attackers to inject malicious SQL because user input is concatenated directly into database queries. Which control is the MOST effective defense?
- ADisabling logging on the database
- BRenaming the database tables
- CIncreasing the database server's available RAM and CPU cores
- DUsing parameterized queries (prepared statements)✓
Answer: Parameterized queries separate code from data so user input is treated strictly as a value, preventing SQL injection.