CISSP Official Practice Tests by Mike Chapple, David Seidl

Chapter 8 ■ Software Development Security (Domain 8) 187

C. SQL injection

D. Cross-site request forgery

55. Which one of the following is not an effective control against SQL injection attacks?

A. Escaping

B. Client-side input validation

C. Parameterization

D. Limiting database permissions

56. What type of project management tool is shown in the figure?

t=3 mo

A

B

50

40

20

10 30

C

E

FD

t=3 mo

t=3 mo

t=4 mo t=3 mo

t=1 mo

A. WBS chart

B. PERT chart

C. Gantt chart

D. Wireframe diagram

57. In what software testing technique does the evaluator retest a large number of scenarios
    each time that the software changes to verify that the results are consistent with a standard
    baseline?
    A. Orthogonal array testing
    B. Pattern testing
    C. Matrix testing
    D. Regression testing


58. Which one of the following conditions may make an application most vulnerable to a
    cross-site scripting (XSS) attack?
    A. Input validation
    B. Reflected input
    C. Unpatched server
    D. Promiscuous firewall rules