CISSP Official Practice Tests by Mike Chapple, David Seidl

Chapter 8 ■ Software Development Security (Domain 8) 197

3. Cross-site request forgery


4. SQL injection
   A. An attack that injects a malicious script into otherwise trusted websites
   B. An attack that is designed to execute commands against a database via an insecure
   web application
   C. An exploitation method that often involves cookies or keys to gain unauthorized
   access to a computer or service
   D. An attack that forces a user to execute unwanted actions in a website or application
   they are currently logged in to


5. Which of the following vulnerabilities might be discovered during a penetration test of a
   web-based application?
   A. Cross-site scripting
   B. Cross-site request forgery
   C. SQL injection
   D. All of the above


6. What approach to technology management integrates the three components of technology
   management shown in this illustration?

Software

Development

Operations

Quality

Assurance

Image reprinted from CISSP (ISC)^2 Certified Information Systems Security Professional Official Study

Guide, 7th Edition © John Wiley & Sons 2015, reprinted with permission.

A. Agile

B. Lean

C. DevOps

D. ITIL