Secure SDLC, application security controls, and software vulnerabilities tested on CISSP Domain 8.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the primary phases of the Secure Software Development Lifecycle (SDLC)?
Show answer
Requirements/Planning, Design, Development, Testing, Deployment, and Maintenance- What is the main goal of threat modeling in SDLC?
Show answer
Identify potential threats and vulnerabilities before development begins- What does SAST stand for?
Show answer
Static Application Security Testing- What does DAST stand for?
Show answer
Dynamic Application Security Testing- What is input validation?
Show answer
Verifying that input data meets expected format, type, length, and range before processing- What is cross-site scripting (XSS)?
Show answer
Injection of malicious scripts into web applications to execute in users' browsers- What is SQL injection?
Show answer
Inserting malicious SQL code into input fields to manipulate database queries- What is OWASP?
Show answer
Open Web Application Security Project, an organization focused on web application security- What are the top 3 items typically in the OWASP Top 10?
Show answer
Broken Access Control, Cryptographic Failures, Injection- What is code review in secure SDLC?
Show answer
Manual examination of source code by peers to identify security flaws and quality issues- What is fuzz testing?
Show answer
Sending random, malformed, or unexpected data to an application to discover vulnerabilities- What is a buffer overflow?
Show answer
Writing data beyond the allocated buffer boundaries, potentially overwriting adjacent memory- What is the difference between authentication and authorization?
Show answer
Authentication verifies identity; authorization grants access to resources based on identity- What is session management?
Show answer
The process of maintaining and tracking user state during their interaction with an application- What is cross-site request forgery (CSRF)?
Show answer
Tricking an authenticated user into performing unintended actions on a website they are logged into
FlashKeepers