Passing CISSP Domain 8 isn't like being a coder; it's like being a judge. You're not writing the law, you're interpreting it under pressure to find the single best precedent, and the exam is designed to find out if you can tell the difference between a good argument and a binding one.
These free practice questions cover the CISSP exam's Domain 8, Software Development Security. They mirror the current exam's format and difficulty, testing your judgment on integrating security into the software development lifecycle (SDLC). Each question includes a detailed explanation of the correct answer and, more importantly, why the tempting distractors are wrong.
Key facts
- Domain Title
- Software Development Security
- Exam Weighting
- 11% of the total score
- Official Body
- (ISC)²
- Passing Score
- 700 on a 1000-point scale
- Exam Format
- Computerized Adaptive Testing (CAT) for English exams (125-175 questions)
- Blueprint Cycle
- (ISC)² updates the exam outline approximately every three years; the current version is the 2024 outline.
Domain 8, Software Development Security, constitutes 11% of the CISSP exam, per the official (ISC)² CISSP Exam Outline. This ensures you will face a significant block of questions on this topic, making mastery essential.
Key Concepts: SAST vs. DAST and Beyond
Mastering Domain 8 requires understanding the practical application of key testing methodologies, particularly the difference between Static (SAST) and Dynamic (DAST) Application Security Testing. Knowing the definition isn't enough; you must be able to choose the right tool for the right phase of a project. The most common point of confusion is between SAST and DAST.
| Feature | Static Application Security Testing (SAST) | Dynamic Application Security Testing (DAST) |
|---|---|---|
| Perspective | White-box (inside-out) | Black-box (outside-in) |
| What it tests | Source code, byte code, or binaries | The running application |
| When it's used | Early in the SDLC (coding, commit phase) | Later in the SDLC (test/QA, staging) |
| Requires | Access to the code or compiled application | A running instance of the application |
| Finds | Coding flaws, insecure patterns (e.g., SQLi) | Runtime issues, server configuration errors |
| CISSP Mindset | The earliest possible intervention ("shift left") | Simulates an external attacker's view |
Beyond testing, you must think about the entire ecosystem. This includes understanding secure coding guidelines from sources like CERT and managing the risk from third-party libraries. This is the core of software supply chain security, a topic of increasing importance. Try VoraPrep's free CISSP practice questions to see how these concepts are tested in realistic scenarios.
Studying for CISSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
CISSP Domain 8 Practice Questions (2026)
These 10 practice questions are designed to test your judgment on core Domain 8 topics, from SDLC models to vulnerability management. For each question, select the best possible answer. The detailed explanations follow the full set of questions.
Question 1
A software development team is building a new financial application. The project manager wants to ensure that security flaws are found as early as possible in the development lifecycle to minimize remediation costs. Which of the following methods should be implemented FIRST?
Question 2
During a code review of a web application, a security analyst discovers the following SQL query being constructed with user-provided input:
String query = "SELECT * FROM users WHERE username = '" + request.getParameter("username") + "'";
This code is vulnerable to which of the following attacks?
Question 3
An organization is adopting a DevOps model to accelerate software delivery. The Chief Information Security Officer (CISO) is concerned that the fast pace of releases will introduce new security risks. Which of the following is the BEST approach to integrate security into the DevOps pipeline (DevSecOps)?
Question 4
A development team is storing application source code, including some configuration files with hardcoded API keys, in a private GitHub repository. A security manager has identified this as a significant risk. What is the MOST effective long-term solution to mitigate this risk?
Question 5
Which software development model is characterized by sequential phases where the output of one phase becomes the input for the next, with a strong emphasis on formal documentation and reviews at the end of each phase?
Question 6
A company wants to assess the security of a third-party, closed-source software application that it plans to deploy in its environment. The company does not have access to the application's source code. Which testing methodology is MOST appropriate in this scenario?
Question 7
The primary purpose of code signing is to provide:
Question 8
What is the primary security benefit of using parameterized queries (prepared statements) when interacting with a database?
Question 9
A software application needs to be resilient against unexpected or malformed data inputs. Which type of testing involves providing a large volume of invalid, random, and unexpected data to the application's inputs to monitor for crashes or security anomalies?
Question 10
In the context of database security, what is the purpose of data normalization?
Detailed Explanations
Explanation for Question 1
✅ Correct Answer: C) Static Application Security Testing (SAST) Why it's right: The question demands the method that finds flaws "as early as possible." SAST analyzes source code, byte code, or binary code without executing it. This can be done as soon as the first lines of code are written, making it the earliest possible detection method in the lifecycle. The CISSP perspective heavily favors "shifting left," which means moving security activities to the earliest possible point in the SDLC. ⚠️ Why the others are tempting but wrong:- A) Dynamic Application Security Testing (DAST): This is a tempting choice, but DAST requires the application to be in a running state. This means it can only be performed later in the lifecycle, typically in a QA or staging environment. It's valuable, but not the earliest.
- B) Penetration testing: This is performed on a fully integrated, running application, often just before deployment. It is one of the latest-stage testing activities.
- D) Fuzz testing: Like DAST, fuzzing requires a running application to bombard with inputs. It happens much later than a static code scan.
Explanation for Question 2
✅ Correct Answer: C) SQL Injection Why it's right: The code snippet directly concatenates a raw, unvalidated user input string (request.getParameter("username")) into a SQL query. An attacker could provide a malicious string like ' OR '1'='1 to alter the query's logic and bypass authentication or dump data. This is the classic definition of a SQL injection vulnerability.
⚠️ Why the others are tempting but wrong:
- A) Cross-Site Scripting (XSS): XSS involves injecting malicious scripts into a web page that are then executed in a victim's browser. The vulnerability here is on the server-side database interaction, not the client-side rendering.
- B) Cross-Site Request Forgery (CSRF): CSRF tricks a logged-in user into submitting a malicious request to a web application they are authenticated to. It doesn't involve manipulating the structure of a SQL query directly.
- D) Buffer Overflow: This involves writing more data to a buffer than it can hold, overwriting adjacent memory. While possible in some languages, the vulnerability shown here is a logical flaw in SQL query construction, not a memory management issue.
Explanation for Question 3
✅ Correct Answer: B) Automate security controls and testing within the CI/CD pipeline. Why it's right: The core principle of DevSecOps is to make security an integrated and automated part of the development process, not a bottleneck. Automating security scanning (SAST, dependency checking) within the Continuous Integration/Continuous Deployment (CI/CD) pipeline allows security checks to happen automatically on every code commit or build. This scales with the speed of DevOps without slowing it down. ⚠️ Why the others are tempting but wrong:- A) Mandate a full security review and penetration test before every release: In a rapid DevOps environment with multiple releases per day, this is completely impractical. It would destroy the speed advantage of DevOps and become a major bottleneck.
- C) Hire a dedicated security engineer for each DevOps team: While having security expertise is good, it doesn't scale well and can still create a dependency. The goal is to empower the development team with automated tools, not to silo security with one person.
- D) Require all developers to attend annual security training: Training is important but insufficient on its own. It's a foundational activity, but it is not the "BEST approach" to integrate security into a fast-paced pipeline. Automation provides the real-time guardrails.
Explanation for Question 4
✅ Correct Answer: B) Use a secrets management system, like HashiCorp Vault or AWS Secrets Manager, and have the application retrieve secrets at runtime. Why it's right: This is the industry best practice and the most robust, scalable solution. Secrets management systems centralize the storage, access control, and auditing of secrets. They remove secrets from the source code entirely. The application is given an identity and authenticates to the secrets manager to retrieve credentials dynamically when it starts up. This is the "managerial" choice that solves the root problem systemically. ⚠️ Why the others are tempting but wrong:- A) Encrypt the API keys within the configuration files: This is a weak control. Where do you store the decryption key? Likely in another file or in the code, which just moves the problem. This is a common trap for those thinking technically instead of architecturally.
- C) Move the configuration files to a separate, more restricted repository: This is security through obscurity. The secrets are still checked into version control, and an attacker who gains access to that "secret" repository has everything. It also creates operational complexity.
- D) Implement a pre-commit hook: This is a good preventative control but not a complete solution. A developer can bypass it (
git commit --no-verify), and it doesn't solve the problem of how to securely provide the secret to the application in production. It's a good tactical step, but B is the strategic solution.
Explanation for Question 5
✅ Correct Answer: C) Waterfall Why it's right: The Waterfall model is the classic, linear-sequential approach to software development. It consists of distinct, cascading phases (Requirements, Design, Implementation, Verification, Maintenance). The key characteristic described in the question, a rigid sequence where one phase must be completed before the next begins, is the definition of Waterfall. ⚠️ Why the others are tempting but wrong:- A) Agile: Agile is an iterative model focused on flexibility, customer collaboration, and rapid, incremental releases. It is the philosophical opposite of the rigid, sequential Waterfall model.
- B) Spiral: The Spiral model is a risk-driven model that combines elements of prototyping and Waterfall. It proceeds in iterative spirals, with a focus on risk analysis in each iteration. It is not strictly sequential.
- D) Prototyping: This model involves building a working model of the system to understand requirements better. It is iterative by nature and is often used at the beginning of a larger project, not as a full lifecycle model itself.
Explanation for Question 6
✅ Correct Answer: D) Black-box testing Why it's right: Black-box testing is a method of software testing that examines the functionality of an application without any knowledge of its internal structures, implementation details, or source code. The tester treats the software as a "black box." Since the company has no access to the source code, this is the most appropriate methodology. ⚠️ Why the others are tempting but wrong:- A) White-box testing: This method requires full access to the source code and internal architecture. It's impossible in this scenario.
- B) Gray-box testing: This method involves having partial knowledge of the internal workings of the system. Since the company has no knowledge, this is not the best fit.
- C) Static Application Security Testing (SAST): SAST is a white-box technique. While some forms of SAST (binary analysis) can be performed without source code, the term "black-box testing" better describes the overall methodology of testing a system with zero internal knowledge.
Explanation for Question 7
✅ Correct Answer: B) Integrity and Authentication Why it's right: Code signing uses a digital signature to achieve several goals. The two listed in this option are correct.- Integrity: The signature is based on a hash of the code. If the code is altered, the hash will change, and the signature validation will fail. This proves the code has not been tampered with.
- Authentication: The signature is created using the publisher's private key and verified with their public key. This proves the origin of the code and authenticates the publisher.
A third key benefit is Non-repudiation: the publisher cannot deny having signed the code. While not listed in option B, Integrity and Authentication are the core services provided, making it the best choice.
⚠️ Why the others are tempting but wrong:- A) Confidentiality: Code signing does not encrypt the code or keep it secret.
- C) Availability and Non-repudiation: While Non-repudiation is a benefit, Availability is not.
- D) Authorization: Authorization (what you're allowed to do) is separate from Authentication (proving who you are). Code signing provides authentication of the source.
Explanation for Question 8
✅ Correct Answer: B) They prevent SQL injection attacks by separating code from user-provided data. Why it's right: This is the primary security function of prepared statements. The SQL query structure is sent to the database engine and compiled first, with placeholders (?) for user input. The user data is then sent separately. The database engine never interprets the user data as part of the SQL command, effectively neutralizing SQL injection attacks.
⚠️ Why the others are tempting but wrong:
- A) They improve database performance: This is a true statement and a significant secondary benefit, but it is not the primary security benefit. The CISSP exam will often include choices that are factually correct but not the best answer to the specific question asked.
- C) They enforce data type validation at the application layer: Data type validation happens at the database layer when the parameters are bound, not the application layer.
- D) They encrypt data in transit: Encryption in transit is handled by protocols like TLS/SSL, which is a separate layer of security.
Explanation for Question 9
✅ Correct Answer: C) Fuzz Testing Why it's right: Fuzz testing (or fuzzing) is the specific technique of providing automated, semi-random data as input to a program to find implementation bugs, crashes, and security vulnerabilities. The description in the question is a textbook definition of fuzzing. ⚠️ Why the others are tempting but wrong:- A) Regression Testing: This type of testing ensures that new changes have not broken existing functionality. It uses a predefined set of test cases, not random data.
- B) Unit Testing: This involves testing individual components or functions of the software in isolation to ensure they work as designed.
- D) Integration Testing: This tests how different software modules interact with each other. It focuses on interfaces and data flows between modules.
Explanation for Question 10
✅ Correct Answer: B) To reduce data redundancy and improve data integrity by organizing columns and tables. Why it's right: Data normalization is a database design technique. Its main goals are to eliminate redundant data (for example, storing the same customer address in multiple tables) and ensure that data dependencies make sense. By reducing redundancy, you also reduce the risk of inconsistencies when data is updated, thus improving data integrity. From a security perspective, improved integrity is a key benefit. ⚠️ Why the others are tempting but wrong:- A) To encrypt sensitive data fields: Encryption is a separate security control applied to data at rest. Normalization is about the logical structure of the data.
- C) To create a complete backup: Backups are a process for availability and disaster recovery, unrelated to the logical design of database tables.
- D) To grant specific user permissions: This describes access control, which is managed through database commands, not through the process of normalization.
Calculate Your CISSP Score & Study Hours by Domain
Adjust your practice scores across official CISSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How to Interpret Your Score
This isn't about passing or failing; it's about diagnosing where to focus your energy.
- 0-4 Correct: You have foundational gaps in software development security concepts. Solidify your understanding of the SDLC and the different development models (Waterfall, Agile). Focus on the process of building software securely.
- 5-7 Correct: You understand the key terms but may struggle with applying them in a scenario. You know what SAST is, but you get tripped up on when to use it versus DAST. Move from definitions to decisions. For every concept, ask: "As a security manager, why would I choose this? What risk does it mitigate?"
- 8-10 Correct: Excellent work. You have a strong grasp of the material. Your challenge is to refine your judgment for the toughest questions that have multiple "good" answers. Focus on identifying the most strategic, scalable, and manager-level solution.
No matter your score, the next step is consistent, targeted practice. If you struggled here, our Free CISSP Practice Questions (2026 Exam Simulator Sampler) is a great place to start building a broad base across all domains.
Get More CISSP Practice on VoraPrep
A short quiz is a great start, but passing the CISSP requires building deep mental models across all eight domains. A random set of questions isn't enough; you need a system.
That's where VoraPrep's complete 6-pillar course comes in. We offer a comprehensive study system designed for busy professionals, moving beyond the passive video lectures that dominate the market.
Our platform includes:
- Textbook-Grade Lessons: Interactive lessons that teach you the concepts step-by-step.
- Adaptive Practice Banks: Over 2,200+ exam-calibrated questions that adapt to your performance, forcing you to spend time on your weak areas.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real Pearson VUE testing environment.
- Spaced-Repetition Flashcards: A smart flashcard system to lock in key terms and concepts.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day to be ready by your exam date.
- Vory, Your 24/7 Personal Tutor: Stuck on a concept? Ask Vory inside any question or lesson for a step-by-step explanation, anytime.
Instead of paying $2,000 for a set of videos, you get a complete, interactive learning system that actively coaches you to a pass. You can review our detailed CISSP exam format breakdown and see how our tools align with the real test.