CISSP Cyber Training Podcast - CISSP Training Program

CCT 239: Practice CISSP Questions - Assess the Effectiveness of Software Security (D8.3)

• Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur • Season 3 • Episode 239

Share episode

Send us a text

Cybersecurity isn't just for enterprises—small and medium businesses face increasingly sophisticated threats with fewer resources to combat them. In this information-packed episode, Sean Gerber explores why cybersecurity matters critically for SMBs while delivering practical CISSP exam questions focused on Domain 8.3.

Sean begins by examining how even non-tech businesses rely heavily on digital systems, making them vulnerable to attacks that could devastate operations. A ransomware incident targeting inventory management or employee scheduling could cripple a small business just as effectively as one targeting a financial institution. Business continuity planning—often overlooked until disaster strikes—becomes a critical safeguard that many small businesses simply don't consider until it's too late.

The economic reality of cybersecurity for small businesses creates a challenging landscape. While virtual CISO services and managed security operations centers offer potential solutions, many remain financially out of reach for smaller organizations. This creates a significant vulnerability gap in our business ecosystem that security professionals must work to address.

The episode then transitions into fifteen carefully crafted CISSP practice questions focusing on Domain 8.3, covering essential concepts like API security, content security policies, message queue poisoning, and the principle of least privilege in containerized environments. Each question explores real-world vulnerabilities while providing clear explanations about proper security approaches.

Whether you're studying for the CISSP exam or working to improve your organization's security posture, this episode delivers actionable insights on identifying and mitigating common application security vulnerabilities. Subscribe to the CISSP Cyber Training podcast for weekly deep dives into cybersecurity concepts that will help you pass your certification exam and become a more effective security professional.

Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Speaker 1:

Welcome to the CISSP Cyber Training Podcast, where we provide you the training and tools you need to pass the CISSP exam the first time. Hi, my name is Sean Gerber and I'm your host for this action-packed, informative podcast. Join me each week as I provide the information you need to pass the CISSP exam and grow your cybersecurity knowledge. All right, let's get started. Let's go.

Speaker 2:

Cybersecurity knowledge All right, let's get started. Good morning everybody. It's Sean Gerber with CISSP Cyber Training, and hope you all are having a beautifully blessed day today. Today is CISSP Question Thursday. So, yes, we are going to be going over CISSP questions related to Domain 8.3, which was part of the podcast that we provided to you all on Monday. So, as you guys are all familiar or maybe you're not familiar is, on Mondays we provide the overall training, that which you can also see on CISSP Cyber Training, but you can see the content that's there as well, as we kind of go over some of the potential questions you may deal with. But on Thursday we specifically go over questions tied to the information that we talked about on Monday. Again, it's a reiteration slash, reinforcement approach with the goal that when you take the test, you will pass it the first time. Right, that is the ultimate goal. So you can go to CISSP Cyber Training head on over there and you can get access to all of my content. I have a bunch of free stuff out there, but the paid stuff, just to be honest, if you're trying to get your CISSP done, the paid stuff will help you get it done in a much quicker timeframe. The free stuff is great. It does its free right. But at the end of the day, if you're trying to get this thing accomplished in a timeframe that meets your goals, the paid program is a much better option for you. But again, it's available to you either way. You just have to choose which way you want to go.

Speaker 2:

But before we get started, I wanted to talk about an article that I saw in Computer World and it's related to why cybersecurity matters for small and medium businesses, and we've talked about this numerous times on this podcast and in through my training. It's really an important part and I kind of have an affinity towards the small and medium businesses because in many cases I mean, I own a small business Now we don't deal primarily with the overall IT functions in the world. I mean, it's a shaved ice truck and it's also a coffee truck, so it's not much in the IT space. However, all of my planning, my integration with my employees, purchasing for my product all that stuff is done online and if it were to go get shut down because of a ransomware attack, it wouldn't kill my business, but it would dramatically impact it and it would be very painful, honestly, because we've become very reliant on this stuff, and many small and medium businesses are in the same boat as me. Many more of them are much more reliant on IT than myself.

Speaker 2:

So one of the things that this article kind of brings up is that cybersecurity is crucial for all SMBs, and it's again basically due to the fact that there's online threats, but also that people are more interconnected with their small and medium businesses, with the online world, that they were before. The other thing they mentioned in this article is the importance of understanding and having business continuity plans for small and medium businesses. Now, as I'm working as a consultant with very large firms, in some cases they don't even have very good business continuity plans. So it depends upon the approach, but it's something that people just don't think about, and they really don't think about it until it's probably too late. So the ultimate point is that it's imperative that you do consider this, and if you guys are studying for your CISSP, you might be brought into a small business and you may have to talk to them about how do they implement a business continuity plan for themselves. You just don't know, and it's imperative that you have some thought process that's been done to it. Regulatory penalties obviously are a risk, especially if you have poor cybersecurity.

Speaker 2:

And now in the United States, with the CMMC, which a friend of mine at PsychX actually they call it PhysX, but his company deals with red teaming and pen testing and so forth and he's getting big into the CMMC part of this and if you're a company that has government contracts, cmmc is a big factor that you're going to have to work through. You want to partner with cybersecurity providers where they can help you with your resiliency and then also help SMBs. You need to really embrace the innovation space and security. I think I've talked to many people that provide security services and they don't really go after the SMBs because, unfortunately, there's just not a lot of money in it, and so I think the virtual CISO and the type of the managed SOC are a really good play for many small businesses just because the costs aren't terribly expensive. But again, you're still going to have to be a really good play for many small businesses just because the costs aren't terribly expensive. But again, you're still gonna have to be a pretty good size small business to be able to afford someone like me, even on a temporary basis, and it's important that you get the protections you need.

Speaker 2:

I'm just trying to figure out how to help best protect small businesses. Realistically, it's gonna be a challenge. It really truly is, so it's gonna be up to somebody that's like taking this course. That is maybe an IT that can provide both security and IT functions as well for a small company. So it's a very interesting time, especially if you're a small business and you need to make sure that you do whatever you can to help protect your company. You need to think about all the different options. So, again, good article. It's pretty quick, easy read about three and a half, four minutes and this is why cybersecurity matters for small and medium-sized businesses.

Speaker 2:

Okay, so let's move on to the questions for today. Okay, so, if you go to CISSP Cyber Training, you'll have access to this. You can just go click on the links, get access to my questions. I've got probably close to around well, man, probably close to about 1,500 questions that are available to you on CISSP Cyber Training. Many of them have majority of them have audio that are associated with them as well.

Speaker 2:

So the goal, though, is is not just to study questions and think you're going to pass the test with the questions. The questions are designed to help you understand the mindset of this role and it's a hard test. It's a really tough one and I just got on with a friend of mine that took my course and he passed it. He's super excited, he's elated, he's over the moon and which he should be, because it's been a bit of a nemesis for him for a while. And it's also the other part of this that people don't think about is knowing the book. Smart is one thing, but sometimes the test anxiety can get to people too. So it's imperative that if you have a good understanding of this content and you feel confident going into it and you've done your homework, that can help reduce those types of anxieties that you may get. So it's just interesting if you guys hear a creaking noise in the back when I'm recording. As I'm recording this podcast, I'm sitting on a chair. It's very creaky. I'm in a hotel room recording this. So, yeah, I apologize for the creaky noise if it's there, all right. So let's get into the questions for today. Again, this is question one and we're dealing over domain 8.3. Okay, question one A development team is utilizing a third-party library within a critical application.

Speaker 2:

A recent security advisory indicated that a high severity vulnerability exists within this library. Which of the following is the most effective action a security professional should recommend A Isolate the application from the network until the library can be updated. B Immediately replace the third-party library with an internally developed alternative. D or C analyze the application's usage of the vulnerable library and then function and whether it's going to be worth it or not. And then, d notify the vendor of the third-party library and request an immediate patch.

Speaker 2:

Okay, so what is the most effective action for a security professional to do in the event that they find this library that has got issues? C analyze the application's usage of the vulnerable library and assess the functions of it to make sure that it's not going to be bad. So the ultimate point is the library itself. So if the library is not used really very well and it's not in a very good it's not something that gets tapped a lot and it's got issues right you need to verify that it's actually going to cause some sort of drama to your program. It could be a library that's not used very often and so therefore it may be something you may want to accept the risk on at that time. Again, you need to kind of understand the overall threat. Is the application behind the firewall Is the application internet, facing Lots of different nuances to it, but analyzing the application's library is a good first step.

Speaker 2:

During a penetration test, the tester identifies a client side vulnerability that allows for execution of arbitrary JavaScript code within the user's browser and when they interact with a specific web page. Which of the following mitigation strategies would provide the most comprehensive protection against this type of vulnerability? So again, pen test happens. Client-side vulnerability allows for execution of arbitrary JavaScript, basically arbitrary code, within the user's web browser when they interact with a specific part of the web page. What's the most comprehensive protection against this type of vulnerability? A implement a content security policy with basically very strict directives. B implementing a strong input validation on a server-side form submission. C utilizing web application firewall with rules designed to detect and block malicious scripts. Or D regularly scan the client-side code for known JavaScript vulnerabilities. Okay, so what is the most comprehensive protection against this type of vulnerability? So you really could easily go to one and A and B on this one right, but what it comes down to is the answer is A implement content security policy with strict directives. Okay, so the content security policy is a browser security mechanism that allows you to define the trusted sources and the resources that can connect to it Scripts, styles, images, all of those things. Now, by setting these directives, you could potentially prevent the browser from taking this information. You would potentially bite off on the implementing strong input validation on all server form submissions. That would be a potential option, but it's not the most comprehensive protection. The most comprehensive is specifically setting the policy on the web browser itself.

Speaker 2:

Question three a security architect is reviewing the security of a newly developed API. They observe that the API relies solely on the client side input validation to prevent malicious data from being processed by the backend. So basically, API is connecting in, it's going to push it out the back end, but they're relying on the input validation on the front end. Which of the following security principles is most directly violated by this design? A defense in depth. B least privilege. C separation of duties or D fail-safe defaults. So most directly violated. Which basically means there's only really one way that you can stop it and it's on the client side. And it would be defense in depth. And the reason is it's A it's because you are not. There's not multiple layers in there. Once they get past the client side and they're assuming that the client side input validation is correct, they get free access into the environment because of the API. So again, I love APIs. They're wonderful, they're great, but they also can be the entrance to Hades. I mean, they can cause you life, all kinds of pain. So make sure you understand that.

Speaker 2:

Question four during a code review, the security analyst identifies a section of code that uses a format string directly from the user's input on a specific logging server. Which of the following is the most significant security risk associated with this practice? A denial of service attack. B information disclosure through logging of sensitive data. C cross-site scripting or xss attacks affecting the log viewers or the blog views, and then the arbitrary code execution on the logging server. Again, what is the most significant risk associated with the part that there's a section of code that uses a formatted string directly from the user's input, and that would be D arbitrary code execution on the logging server. Again, arbitrary code could occur again when they have directly access to it and they can end up putting some sort of string into there. It could cause some level of access issues or potentially cause you gain access to the server itself, and this is on the logging server. So this would be question D.

Speaker 2:

Question five a security team is investigating a series of escalating privilege exploits in a legacy application. They discover that the specific api endpoint again I love apis intended for the administration's users, does not adequately verify the user's role on the server side before processing sensitive commands. Which of the following is a vulnerability? Vulnerability categories best describes this specific issue? Okay, so, again, api it't validate adequately verify the user's role on the server side. What is it? So one of the questions, or I should say one of the answers, is A cross-site script request forgery, csrf. B insecure direct object reference. C injection flaws. Or D broken access controls. Again, what's the best one that describes this specific issue? And the answer is D broken access control. Okay, so the vulnerability it can directly access the failure to properly enforce the authorization right. So the API endpoint should be verifying the user's role within the company or within the actual, not the company itself, but within the server itself, and it should do this before it allows any sort of access to its capabilities. So it's important that you do this, that you understand that broken access control in this specific question is how the API would gain access.

Speaker 2:

Question six during the security assessment of a mobile application, a tester discovers that sensitive user data, including API keys and session tokens, are being stored in the application's local file system, and then it doesn't have any encryption on it on top of that. Not a good spot. So if an attacker gains a physical access to the device, what is the most likely immediate impact? Api keys, session tokens they're all stored on the local file system without encryption. A attacker can interrupt the network communication initiated by the application. B the attacker can directly access sensitive data and the accounts and perform actions on their behalf. C the attacker can bypass multi-factor authentication mechanisms with the application. Or, d the attacker can inject malicious code into the application's runtime environment. Okay, so in this situation, like we talked about, access to sensitive data is sitting unencrypted on the file shares or file store. And the answer is B the attacker can have direct access to the sensitive user accounts and perform actions, potentially on their behalf. That is what would happen if they had physical access to it. Again, strong API keys and session tokens being unencrypted is not a good option. You want to make sure that you have some level of encryption on this data, especially as we're dealing with APIs.

Speaker 2:

Question seven a web application utilizes a complex series of chained microservices to fulfill user requests. A vulnerability in one of the lower level microservices allows an attacker to inject arbitrary data into a message queue used for inter-service communications. This injection data can be then processed by subsequent microservices, leading to unintended behavior and potential security breaches. Which of the following attack vectors best describes this scenario? So again, message queuing is where you're at. Vulnerability in one of the microservices allows for you to inject arbitrary data into this message queue. So that'd be a key term to keep in mind. A server-side request forgery, ssrf. B message queue poisoning. C cross origin, resource sharing, misconfiguration that's a bunch of big $10 words C-O-R-S and then D XML external entity injection Okay. So Bess describes a scenario it would be message queue poisoning. Okay. This describes a scenario where the attacker injects malicious data into a message queue. This poison message is then consumed and processed by the other services within the chain, again potentially leading to some sort of exploitation. So the message queue poisoning.

Speaker 2:

Question eight A security analyst is reviewing the deployment of a pipeline for a critical web application. They notice that the static code analysis is performed and the results are not systematically reviewed or acted upon before code is being deployed into production. Ah, not good. Which of the following best describes the security implication of this practice. So again, the security analyst reviewing the deployment pipeline, which is usually for a CICD type pipeline for a critical web application, they notice that the static code analysis, or SAST, is performed, but the results are not systematically reviewed or acted upon before the code is deployed. What does that mean? Well, a reduced effectiveness of the static code analysis in the tool mitigating security risks. So basically saying that the SAST is not helping people reduce the risk of your security issues. B increased supply chain attacks due to unaddressed vulnerabilities in dependencies. B potential for the denial of service attacks due to performance issues. Or D higher likelihood of introducing vulnerabilities due to the lack of automated security testing in their later stages. Okay, there's a lot of words there, but bottom line the answer is A reduced effectiveness for a static code analysis tool in mitigating security risks. Okay, it's happening right. So the tool is monitoring it. The problem is that it's not being systematically reviewed, either through automation or through eyes on keyboard. So your vulnerabilities, you're getting some risks that are getting pushed and passed on.

Speaker 2:

To Question nine a development team is implementing a feature that requires the application to interact with an external payment gateway. The security architect recommends using a client-side integration method where the user's payment details are directly submitted to the gateway from the user's browser. Which of the following is the most significant security concern associated with this approach? So, again, they're implementing a feature that requires application to interact with external payment gateway. Okay, so, money's trading hands. The security architect recommends using a client-side integration method where the user's payment details are directly submitted to the gateway. Hmm, that could be bad. I mean, it's not terrible, but there's things that could happen with this. Right, it's not the best approach. So what is the most significant security concern associated with this approach? A increased server load due to handling sensitive payment data. B difficulty in implementing robust fraud detection mechanisms on the server side. C potential exposures to payment details due to a man-in-the-middle attacks with malicious JavaScript. And then D incompatibility with certain regulatory compliance standards like PCI DSS. Okay, so, again, this is happening on the client side. What is the most security concern, the most significant security concern with this approach? And the answer is C potential exposure of payment details to a man in the middle, attack and malicious JavaScript. Right, so it's all on the client side, while the client side integrations can offer some performance benefits. Right, because now that all the processing is happening at the client, they do introduce significant security risks. And again, this can happen where, if there's using some not properly secured gateway or connection between the client side and the gateway obviously using strong TLS or something like that they can get into some level of man-in-the-middle attacks which could then basically compromise their credentials and any sensitive data. So it's not the best approach.

Speaker 2:

Question 10. During a forensics investigation of a compromised server, analysts discover evidence of a vulnerability where the attacker was able to manipulate the arguments passed to the operating system via a command line and then they can execute them by their web application. The result in the attacker gaining unauthorized access to the file system. Which of the following vulnerabilities best describes this scenario? Okay, so again an attacker. That's a really run-on, long sentence. But the attacker was able to manipulate arguments passed to the operating system via command line, so he or she can push them that way. This results in the attacker gaining unauthorized access to a file system. Specifically, so what is the best scenario or what vulnerability is best described in this scenario? I can't speak, sorry, it's a bit early this morning. A directory traversal. B command line injection. C local file inclusion or D remote file inclusion. So again, what is the best one here? That describes a situation, and it would be B command line injection, command injection this is where you occurs. Obviously, the application passes unfiltered user supply data directly to the operating system via a shell for execution and this then can, by manipulating the arguments, the attacker was able to alter the intended command and execute arbitrary commands. So you can use those. Command line is a typical use for many attackers and if they can do that, then they can gain access to different types of systems. You try to turn that off if you can. If there's some way of making that happen within your server side, you want to make sure you turn those things off.

Speaker 2:

Question 11, a security architect is designing a secure software development lifecycle SSDLC for a new cloud native application. They want to incorporate security testing early and frequently in the development process. Which of the following practices would be most effective in achieving this goal? So again, ssdlc or SDLC, depending on who you talk to for a new cloud-native application. So they want to incorporate security testing early and frequently in the development process. So what is the most effective way of achieving this?

Speaker 2:

A integrating static application security testing tools in the CI-CD pipeline to analyze code changes automatically. B implement a weekly penetration test scheduled and develop in the development environment. So basically, do pen tests all the time. C conducting a comprehensive security code review only before each major release. Or D relying primarily on dynamic application security testing in the staging environment. So again, the best, the most effective in achieving this goal. Ideally, if you could incorporate SAST and DAST in this would be great, but the questions aren't saying that. So you want to integrate static application security testing into the CICD pipeline to analyze code changes automatically. You want to have SAST running, and the reason that the last one isn't good is because you're relying primarily on das. You don't want to rely primarily on das because that's the dynamics part of this. You want the static code analysis to occur, probably more important than the dynamic, and so it's it's imperative that you doing. Both is what would ideal, but if you had to pick one, the answer would be a question 12.

Speaker 2:

A legacy application uses custom authentication mechanisms. Question 12, a legacy application uses custom authentication mechanism that relies on reversible encryption algorithm to store user passwords in its database. Which of the following is the most critical security weakness of this approach? Following is the most critical security weakness of this approach? So again, legacy application using custom authentication mechanisms that relies on reversible encryption algorithm. It's unique to store user passwords in a database, which is the most critical security weakness in this approach A increased computational overhead due to the authentication process. B potential for dictionary attacks will easily crack the encrypted passwords. C difficulty in integrating with modern multi-factor authentication systems. Or D risk of complete password disclosure if the encryption key is compromised. And the answer is D risk of complete password disclosure if the encryption key is compromised. Obviously, storing this data and having the algorithm available to potentially re-engineer it or to decrypt the potential algorithm or utilizing the algorithm is a bad thing. So you want to avoid that at all costs.

Speaker 2:

Question 13, a security team discovered that a web application is vulnerable to server-side request forgery SSRF attack. The attacker can manipulate the application to make requests to internal resources that are not publicly accessible. That's not good. Which of the following mitigation strategies would be most effective in preventing future SSRF attacks? Okay, server-side request forgery. So A implement strict network segmentation to isolate internal resources. B whitelisting allowed destination hosts and ports for outbound requests. C disabling all external network connectivity from the web server. Or D implementing strong input validations on all user-supplied URLs. So again, we're dealing with a server-side forgery attack. They want to manipulate the application to make requests to internal resources that are not publicly accessible, and what you would do is you would be whitelist the allowed destination hosts and ports for outbound requests. That would be the most effective by doing this, and so the network segmentation that you put is a good thing, right, but by whitelisting it provides more specific and effective controls against SSRF, and then, by defining these specifically, you can allow legitimate external resources that the application needs to access, and then any attempts outside of that would be denied. So again, disabling all external connectivity might be a bit too restrictive and potentially break the functionality of it. So you want to think about that as well.

Speaker 2:

Question 14. During penetration tests, the tester successfully exploited XML external entity vulnerability with an application that processes XML data. Which of the following outcomes is a potential consequence of a successful XXE attack or XML external entity attack? A Unauthorized access to local files on a server hosting the application. B Cross-site scripting attacks against other users of the application. C denial of service due to excessive resource consumption on the client side. Or. D SQL injection attacks against the backend database. Again during a penetration test, a tester successfully exploited XML external entity vulnerability, and which of the following is a potential consequence of a successful XXE? And the answer is A unauthorized access to local files on the server hosting the application. So again, that is the answer. Question 15, the last melon.

Speaker 2:

A security analyst is reviewing the security of a containerized application deployed using Kubernetes. They observe that the application containers are running with root privileges within their pods Not a good option. Which of the following security principles is the most directly violated by this configuration? So again, kubernetes, application, and they're running with root A principle of least privilege. B defense in depth. C separation of duties. D failsafe defaults Again, the most security principles that are most directly violated with this configuration? And the answer is A principle of least privilege. Right, so you want to have the principle of least privilege, especially with these clusters, and by giving them root, you are not doing least privilege, you're giving them more privileges and you are giving. That's not good, so we want to avoid that. So that's the most violated part of all this of the security principles is the principle of least privilege. Okay, that is it. That's all we have for you today.

Speaker 2:

Head on over to CISSP Cyber Training. Get access to all of my content. You can do it. There's a lot of free stuff out there, but, like I said, mentioned before, the paid stuff is what's going to help you get the test done in the timeframe that you want to do, when the free stuff do it, sure, but it won't be able to help you in the time that you potentially need. If you're trying to get this thing done quickly, look at the content that I have, look at the different packages that are available to you, and all of that can be given to you. Just all you got to do is purchase it. So, have a wonderful, wonderful day and we will catch you.

People on this episode

Head Shot

Shon Gerber

Host