Domain 8 Practice Test: Software Development Security

How to take this test

Domain 8 is two halves wearing one label. Chapter 29 built the frame: the lifecycle in which software is conceived and built, the models and where security lives in each, the DevSecOps operating model, the delivery pipeline as a system with its own attack surface, and the change and supply chain governance that wraps around the whole thing. Chapter 30 built the craft: the taxonomy of defects, the tool family that finds them, and the coding disciplines that keep them out. The 25 questions below are drawn from both, and they are written to test the seam between the halves as much as the facts inside them. A question about an SBOM is a question about the pipeline; a question about parameterized queries is a question about the coding floor; and a question about where a review gate belongs is a question about whether you see software development as a control or as an event.

Two skills carry this domain, and both are on display here. The first is placement: given an activity, you must say which phase of the lifecycle owns it. Requirements, design, implementation, testing, deployment, operations, retirement: every security activity has a natural home, and the exam tests the boundaries between these phases the same way it tests the boundaries between every other pair in the curriculum. The second skill is control selection: given a defect class, you must choose the control that removes the class at its root, not the control that patches one instance. When you read a stem, run both checks before you look at the options. Whose phase is this, and which control kills the class?

The versioned facts here are drawn from the standards the two chapters cite, and the rationales name them: NIST SP 800-218 SSDF Version 1.1, NIST SP 800-53 Revision 5, ISO/IEC 27001:2022 Annex A, PCI DSS v4.0, ISO/IEC 5962:2021, and the OWASP taxonomy of the Top 10. Where a question turns on a number or a format, the rationale gives the source.

Set the clock for thirty minutes before you read the first stem: a minute and a quarter per item, the same pace this book assumes throughout its practice material. Answer every question, even the ones you would rather skip, because a blank is wrong and the real engine never asks why you left it empty. Do not open the answer key early, and do not return to a question once you have moved past it. The adaptive exam gives you no item review, and the practice that transfers is the practice that reproduces that constraint. When a question forces a guess, guess cleanly and keep moving. The score sheet is where the analysis happens, not the test session.

When the clock stops, score yourself honestly and read the score interpretation before you touch anything else. The number is a triage instrument, not a verdict. It tells you which part of Domain 8 deserves your next study hours, and the specific questions you missed tell you which exact ideas to rebuild.

The 25 questions

1. A project manager runs a waterfall project and schedules a single comprehensive security review immediately before deployment, arguing that security is best evaluated once the whole system exists and can be tested end to end. Which response is correct?

   A. This placement is waterfall’s intended security home, because the full-system review exercises every component together B. Security has no home in waterfall, because the phases are fixed and none of them owns security C. Security’s home in waterfall is the phase gates: a security review at the end of design, a security test plan at the end of implementation, and a security acceptance gate before deployment. Treating security as the last gate converts every discovered flaw into a schedule crisis D. Waterfall is exempt from security review because its requirements are fixed before any code is written

2. An aerospace team must demonstrate to a regulator that each safety requirement was verified by a corresponding test, with the mapping explicit and auditable. Which development model is best suited to that demonstration?

   A. The V-model, because each test level links back to the requirement or design level it verifies, making traceability the geometry of the model itself B. Waterfall, because its phases are strictly sequential and therefore auditable C. The spiral model, because its cycles produce repeatable risk records D. Kanban, because limiting work in progress produces a visible verification queue

3. A scrum team schedules security work as a single item in the final sprint before release, and drops it when the sprint gets tight. Which correction reflects the model’s real discipline?

   A. Keep the final-sprint placement but protect it with a buffer B. Move security out of the iteration entirely and review after release C. Treat security as a phase that begins when the sprints end D. Make security a property of every increment: per-story acceptance criteria and a Definition of Done that includes the security checks, so nothing ships without them

4. During the requirements phase, a team writes a set of scenarios describing what a hostile actor will attempt against the application, such as logging in as another user or escalating privileges, and records each scenario as a defensive requirement. What is this artifact called?

   A. A security test plan B. A threat model C. A misuse case, also called an abuse case D. A penetration test

5. A project involves genuinely high risk, and the manager wants threat modeling, vulnerability analysis, and risk resolution to happen on a schedule throughout development rather than once at the end. Which development model builds that rhythm into its own loop?

   A. Waterfall, at its design gate B. The V-model, along its verification spine C. The spiral model, in the risk-identification quadrant that every cycle passes through D. Kanban, through work-in-progress limits

6. A product team reports that every commit must wait for sign-off from a central security review team before it can merge. Which statement about this arrangement is correct?

   A. It is the defining practice of DevSecOps, because a central expert holds the bar for everyone B. It is acceptable DevSecOps as long as the sign-off is automated C. It recreates the gate that DevSecOps exists to remove: security accountability should be shared with the product team, with security specialists acting as consultants, reviewers, and standards-setters rather than gatekeepers on every commit D. It is required by ISO/IEC 27001:2022 Annex A 8.28

7. A DevSecOps program selects metrics for its dashboard. Which metric is a security-flavored addition to the DORA four rather than one of the four core DevOps metrics?

   A. Deployment frequency B. Lead time for changes C. Change failure rate D. Time to remediate a vulnerability

8. An outage demands an immediate production fix, and the change team invokes the emergency change path. Which requirement still applies?

   A. The change is documented, reviewed after implementation, and still carries a backout plan, because urgency is not a license to skip reversibility B. All approval, documentation, and review are waived so the fix can ship immediately C. The backout plan may be skipped whenever the fix is small D. The change is exempt from the audit trail because it was time-critical

9. A test team copies a month of production customer data, unmasked, into the staging environment so the tests look realistic. Which control does this practice violate, and what is the correct behavior?

   A. Annex A 8.31, separation of environments: the violation is that staging exists at all B. Annex A 8.34, protection during audit testing: the copy must be agreed in advance C. Annex A 8.33, test information: test data must be selected, protected, and controlled, and production data, especially personal data, must not be used in test environments without masking D. NIST SP 800-53 CM-5, access restrictions: only testers may see the data

10. An organization outsources the development of a critical application to a vendor. Under ISO/IEC 27001:2022 Annex A 8.30, which statement is correct?

    A. The organization must direct, supervise, and monitor the outsourced development, because outsourcing transfers the work, not the accountability B. The vendor assumes full accountability for the software’s security once the contract is signed C. Outsourcing is permitted only when no personal data is involved D. Acceptance testing of the vendor’s deliverables is waived once the contract assigns liability

11. A procurement team asks what a software bill of materials (SBOM) actually does. Which statement is correct?

    A. An SBOM is a machine-readable inventory of the components, including third-party and open-source components and their versions, that make up a piece of software; common formats include SPDX, standardized as ISO/IEC 5962:2021, and CycloneDX B. An SBOM is a vulnerability scan report that lists which CVEs in a product are currently exploitable C. An SBOM certifies that the software contains no known vulnerabilities D. An SBOM is a legal contract between the supplier and the acquirer governing liability for defects

12. A build fetches a package by name from the public package registry. An attacker publishes a package with the same name as the organization’s internal package, and the build resolves the attacker’s copy instead of the private one. What is this attack, and which defense most directly counters it?

    A. Typosquatting; add a web application firewall rule B. Log4Shell; update the logging library C. Dependency confusion; pin exact versions in lock files and serve dependencies from a vetted private registry so resolution cannot fall through to the public one D. Package tampering; sign the final artifact after the build

13. A security engineer wants assurance that the artifact deployed to production is exactly the artifact that passed testing, and that tampering with either would be detectable. Which practice set accomplishes this?

    A. Encrypting the artifact repository with a strong key B. Running dynamic scans against the artifact after deployment C. Signing the artifact so consumers can verify who produced it and that it has not been altered, plus hermetic or reproducible builds that produce the same output for the same source D. Retaining build logs for the full retention period

14. A vulnerability researcher publishes an advisory for a flaw in a popular library. Which set correctly matches the three-layer vocabulary of the profession?

    A. CWE is the weakness type, CVE is the specific instance, CVSS scores the severity B. CVE is the weakness type, CWE is the specific instance, CVSS is the exploit code C. CVSS is the weakness type, CWE is the score, CVE is the catalog of types D. CWE and CVE are synonyms for the same registry, and CVSS is maintained by MITRE

15. A search page concatenates the user’s search term directly into a SQL statement. A tester submits ' OR 1=1 -- and receives the entire table in the results. Which control eliminates this vulnerability class at its root?

    A. A web application firewall rule that blocks the OR keyword in search requests B. Input validation that rejects the quote character in search terms C. A parameterized query that sends the query template and the values as separate data, so the input can never enter the query grammar D. A stored procedure that runs the same concatenated query on the database server

16. A collaboration tool stores user comments and renders them to every viewer. A user posts a comment containing a script tag, and the script executes in the browser of every member who opens the thread. What is the vulnerability class, and what is the primary control?

    A. Stored XSS; context-aware output encoding when the stored comment is rendered B. Reflected XSS; validate the comment length at the input boundary C. DOM-based XSS; add the HttpOnly attribute to the session cookie D. CSRF; require a token on the comment submission endpoint

17. A user’s banking session cookie is attached automatically by the browser to cross-site requests. An attacker’s page triggers a state-changing request, and the bank cannot distinguish it from the user’s own action because the evidence it holds, the cookie, is identical. Which server-side control directly defeats the attack?

    A. The HttpOnly attribute on the session cookie B. A synchronizer token: an unguessable, session-bound value embedded in forms and verified on every state-changing request, which the attacker’s page cannot read or reproduce C. A Content Security Policy header that restricts script sources D. The HSTS header that forces HTTPS for the session

18. An application feature accepts a URL from the user and the server fetches it. A user submits http://169.254.169.254/latest/meta-data/ and receives the cloud instance’s metadata, including temporary credentials. What is the vulnerability class, and which control most directly prevents it?

    A. SSRF; allowlist permitted destinations and reject private, loopback, and link-local addresses after DNS resolution, so the fetch cannot reach the metadata service B. Open redirect; require a redirect allowlist on the fetch endpoint C. Command injection; sanitize the URL before the fetch D. DNS rebinding; pin the resolution records for the fetch target

19. An API accepts an order ID in the URL and returns the order. Any authenticated user can request any ID and read other customers’ orders. What is the vulnerability class, and what is the fix?

    A. Session fixation; rotate the session ID after login B. Injection; parameterize the order lookup query C. Misconfiguration; hide the order ID from the URL D. An insecure direct object reference, a form of broken access control; enforce authorization on the server for every object access, checking identity and ownership

20. An application accepts serialized objects from authenticated clients and reconstructs them. A crafted payload executes code during reconstruction through a chain of legitimate classes. What is the class, and what is the correct control?

    A. XXE; disable external entities in the parser B. Insecure deserialization (CWE-502); avoid deserializing untrusted data, and where unavoidable, allowlist permitted classes and verify integrity C. A buffer overflow; enable ASLR and stack canaries D. XSS; encode the serialized payload before reconstruction

21. A funds-transfer function checks that the account has sufficient balance, and then performs the debit in a separate, later step. An attacker changes the balance between the two steps. What is the flaw, and what is the control?

    A. A session issue; re-authenticate the user before the transfer B. An input validation failure; reject negative transfer amounts C. A logging failure; record the balance at check time for the audit trail D. A time-of-check-to-time-of-use (TOCTOU) race; make the check and the act atomic, through locking or through an operation that is atomic by construction

22. A tester has no access to the application’s source code and probes a running staging instance by sending crafted requests through its external interfaces and observing the responses. Which approach is this?

    A. Static application security testing B. Software composition analysis C. Manual design review D. Dynamic application security testing

23. An application parses XML documents submitted by users. A crafted document references an external entity that reads a local file, and the server returns the file’s contents in the response. What is the class, and what is the fix?

    A. Path traversal; canonicalize the file path before use B. XXE (CWE-611); configure the parser to disable DTD processing and external entity resolution C. SSRF; validate the document’s source before parsing D. Insecure deserialization; sign the document before parsing

24. An organization implementing ISO/IEC 27001:2022 asks what Annex A 8.29 requires of its development function. Which statement is correct?

    A. Security testing must be performed during the development and acceptance phases B. All software must be developed in-house with no third-party components C. Penetration testing must be performed quarterly by an external vendor D. Developers must hold a recognized security certification before writing code

25. An organization develops custom payment software in-house. Under PCI DSS v4.0 Requirement 6, which practice is explicitly required?

    A. The software must be reviewed prior to release or deployment using automated tools or manual review, and code changes must be reviewed by an individual other than the originating developer B. All code must be written in memory-safe languages C. Automated scanning on every commit satisfies the requirement even if nobody reviews the results D. Third-party components must be replaced with custom implementations

Answer key and rationales

1. C. Security’s home in waterfall is the phase gate: a security review at the end of design, a security test plan at the end of implementation, and a security acceptance gate before deployment. The model’s failure mode is the temptation to treat security as the last gate, which converts every discovered flaw into a schedule crisis, exactly the crisis this plan creates. Option A praises the placement the model punishes, and the other options misstate the model’s relationship to security.

2. A. The V-model’s whole point is traceability: unit tests verify the detailed design, integration tests verify the high-level design, system tests verify the requirements, and acceptance tests verify the business need, with each test level tied by a line back to the level it verifies. That explicit, auditable mapping is what a regulator asks to see. The other models verify too, but none makes the requirement-to-test correspondence the geometry of the model itself.

3. D. The agile family’s failure mode is security treated as a backlog item that never reaches the top, or as a phase after the sprints end, which recreates waterfall’s last-gate problem without waterfall’s discipline. The correction is to make security a property of every increment: security acceptance criteria attached to user stories, security tasks estimated like any other work, and a Definition of Done that includes the security checks. None of the other options puts security inside the iteration where the model lives.

4. C. A misuse case, also called an abuse case, inverts the normal use case: it describes what a hostile actor will try to do, and each misuse case produces a defensive requirement. It is a requirements-phase artifact, not a plan, a model, or a test. Threat modeling is the broader activity that asks what could go wrong; the misuse case is the specific inverted-narrative form, and the exam distinguishes the two.

5. C. The spiral model, proposed by Barry Boehm in 1988, builds risk analysis into the loop: every cycle passes through four quadrants, and the second, identify and resolve risks, is where threat modeling and vulnerability analysis happen on a schedule. For high-risk projects it is the model that forces the conversation the others postpone. The other options place risk work outside the repeated rhythm.

6. C. Shared accountability is the DevSecOps operating model: the product team owns the security of its product, with security specialists as consultants, reviewers, and standards-setters rather than gatekeepers. A team that needs the security team’s sign-off on every commit has not adopted DevSecOps, it has recreated the gate. Automation and central expertise are both part of the model, but neither converts a per-commit approval queue into DevSecOps, and ISO 8.28 requires secure coding principles, not a central approval gate.

7. D. The DORA four metrics are deployment frequency, lead time for changes, change failure rate, and time to restore service. Time to remediate a vulnerability is a security-flavored addition that a DevSecOps practice layers on top, along with vulnerability density, the age of the oldest unpatched critical issue, and the share of changes that passed automated security checks. The other three options are core DORA metrics.

8. A. The emergency change bypasses or compresses the normal approval path, but it is documented, reviewed afterward, and still carries a backout plan, because urgency is not a license to skip reversibility. The change record and the post-implementation review are what keep the system accountable. The other options treat the emergency path as a license to abandon the discipline, which is precisely what it is not.

9. C. Annex A 8.33, Test information, requires that test data be selected, protected, and controlled, and that production data, especially personal data, not be used in test environments without masking. Unmasked customer data in staging is a breach waiting to be discovered. Annex A 8.31 governs environment separation and 8.34 governs audit testing, and CM-5 governs who may implement changes; none of them is the control this scenario violates.

10. A. Annex A 8.30, Outsourced development, requires that outsourced development be directed, supervised, and monitored by the organization, because outsourcing transfers the work, not the accountability. The practical expression is contractual, with security requirements, delivery standards, acceptance criteria, and the right to verify, and the organization must exercise that right. The other options hand the accountability away or waive the verification, which is the exact mistake the control exists to prevent.

11. A. An SBOM is a machine-readable inventory of the components, including third-party and open-source components and their versions, that make up a piece of software, with SPDX, standardized as ISO/IEC 5962:2021, and CycloneDX among the common formats. Its uses are inventory, vulnerability matching, license compliance, and supply chain analysis. The critical qualifier is that an SBOM does not fix vulnerabilities; it makes the vulnerability conversation possible, because a consumer cannot know whether a CVE affects its software without knowing that component Y at version Z is inside it. The other options overstate what the document alone does.

12. C. This is dependency confusion, where a package with the same name as an internal package is published to a public registry and resolves instead of the intended private one. The defenses are pinning and lock files, which fix exact versions and their hashes, serving dependencies from a vetted private registry, and continuously verifying third-party components per SSDF PS.3. Typosquatting is the similar-name variant, a WAF does not govern package resolution, and post-build signing addresses artifact integrity, not which package was fetched.

13. C. Signing the artifact lets consumers verify who produced it and that it has not been altered, and hermetic or reproducible builds, which depend only on pinned inputs and produce the same output for the same source, make tampering detectable by construction. Encryption of the repository (option A) protects storage but says nothing about whether the artifact was altered before or after storage, scans after deployment (option B) test behavior rather than integrity, and log retention (option D) records history without proving identity or purity.

14. A. CWE, curated by MITRE, classifies the weakness type; CVE names the specific instance in a specific product; CVSS, maintained by FIRST, scores the severity, with the NVD enriching CVE records with scores and affected-version data. The other options swap the layers or misattribute the maintainers.

15. C. The vulnerability is SQL injection, and the root-cause control is the parameterized query, also called a prepared statement, which sends the query template and the values separately so the input can never alter the query grammar. WAF rules (option A) and quote rejection (option B) are bypassable compensating controls, and a stored procedure (option D) is only safe if it itself avoids dynamic string concatenation, which the scenario does not establish.

16. A. The comment is saved and served later to every viewer, which is the defining property of stored XSS, and the primary control is context-aware output encoding at the point where the stored text is rendered, because validation at the input boundary cannot see the output context. Length checks (option B) miss the class, HttpOnly (option C) limits what a successful XSS can steal rather than preventing it, and a token (option D) addresses CSRF.

17. B. The attack is CSRF: a state-changing request issued from the victim’s browser with the session cookie attached automatically, so the server must require evidence of intent. The synchronizer token is that evidence: an unguessable value the attacker’s page cannot read, because the same-origin policy prevents it, and the server verifies on every state-changing request. HttpOnly (option A) protects the cookie from script theft, CSP (option C) restricts script execution, and HSTS (option D) enforces transport security; none of them distinguishes the user’s intent from the attacker’s request.

18. A. The vulnerability is SSRF: the server fetching an attacker-chosen URL, and 169.254.169.254 is the cloud metadata address that hands out temporary credentials and instance configuration to any process that can reach it. The direct control is destination validation at the resolved-address level: an allowlist of permitted hosts that rejects private, loopback, and link-local ranges, because an allowlist on the literal hostname can be defeated by DNS tricks and redirects. The other options address different classes or control only the response.

19. D. This is an insecure direct object reference, IDOR, the representative flaw of broken access control: the application exposes an object identifier and trusts that users will only ask for their own. The fix is server-side authorization on every object access, deny by default, with the check based on identity and ownership. Session rotation (option A), parameterization (option B), and hiding the identifier (option C) do not change who is permitted to read the order.

20. B. The class is insecure deserialization, CWE-502, where a crafted serialized payload executes code during reconstruction through gadget chains, prebuilt sequences of legitimate classes whose side effects become the exploit. The control is to avoid deserializing untrusted data entirely, and where unavoidable, to allowlist permitted classes and verify integrity with signatures. The other options address classes the scenario does not describe.

21. D. The flaw is a time-of-check-to-time-of-use race: the balance is checked, then used in a separate later step, and an attacker can change the state between the two. The control is to make the check and the act atomic, through locking or through an operation that is atomic by construction. Re-authentication (option A) does not make the two steps atomic, rejecting negatives (option B) misses the race entirely, and logging (option C) records the failure rather than preventing it.

22. D. Probing the running application through its external interfaces, without the source, is dynamic application security testing, which sees what an attacker sees: reachable endpoints and real responses. SAST (option A) analyzes source without running it, SCA (option B) inventories dependencies, and design review (option C) works on documents rather than the running system.

23. B. The class is XXE, CWE-611, where an XML parser configured to resolve external entities reads local files or makes internal requests on the parser’s behalf, and the fix is to disable DTD processing and external entity resolution in the parser. Path canonicalization (option A) addresses traversal, and the other options address different classes that do not involve the parser resolving an entity reference.

24. A. Annex A 8.29, Security testing in development and acceptance, requires security testing during the development and acceptance phases, which is the phase placement of the tool family from Chapter 30. The other options state obligations the control does not impose: nothing in 8.29 forbids third-party components, mandates external quarterly tests, or requires developer certification.

25. A. Requirement 6 requires bespoke and custom software to be developed securely, with the software reviewed prior to release or deployment using automated tools or manual review, and code changes reviewed by an individual other than the originating developer, alongside the vulnerability management loop of its sub-requirements: inventory of bespoke and custom software and third-party components, risk-ranked vulnerabilities, and patching within defined timeframes. The other options describe practices Requirement 6 does not require, and option C contradicts the requirement that review occur.

Reading your Domain 8 score

Score yourself against the bands this book set in Chapter 1 for every domain test:

The single number hides the information you need, so break the misses down by area. Domain 8 is two halves under one label, the frame and the craft, and the triage that matters is at the topic level:

Two habits make the score useful. First, log the result and the area misses on your score sheet, because the full practice exam in Chapter 33 will re-test this domain and you want the comparison. Second, treat a miss pattern as a question about process, not just facts. If your misses cluster on questions 1 through 13, your problem is placement: you are not yet naming the owning phase or the owning governance before you read the options. The fix is to walk the lifecycle out loud for every scenario: what phase is this, and which standard says so. If your misses cluster on questions 14 through 25, your problem is control selection: you know the defect classes but not the controls that remove them at the root. The fix is to redraw the class-to-control table from Chapter 30 cold: class, defining control, and the control that only patches the symptom.

What the score means for your plan

Domain 8 carries 11 percent of the current outline’s weight, the lightest domain, but it is the domain where the exam’s view of the future runs. The lifecycle questions reward the manager who knows where each security activity belongs and who governs change, environments, and vendors as the controls they are. The craft questions reward the professional who can name a defect from a description and choose the control that kills the class, not the one that patches the instance. The seam questions, the ones that mix pipeline and code, reward the reader who sees that an SBOM and a parameterized query are the same discipline at different ends of the delivery chain: know what is inside, and never let untrusted input become code.

Domain 8 also closes the domain loop. Parts II through IX have now covered all eight domains, and the questions in Chapter 33 will draw on every one of them. If your score shows the frame and the craft in balance, you are ready for the exam-strategy material that follows and for the full practice exams. If it shows one half missing, that half is where your hours go, because the full practice exam will test the same material from a different angle, and the weak half will be waiting there.

One thing worth noticing as you close Part IX: you have now finished the last content domain. Part X is the endgame, exam strategy and the full 125-question practice exam, and after that the material belongs to the test-taker’s craft rather than the security professional’s. The habit that got you here, name the function, then choose the control, is the same habit the exam rewards on every one of the remaining 125 items. Log the misses, fix the weak areas, and carry the whole eight-domain frame into the endgame with you.