CISSP Domain 8 practice questions
Software Development Security
Domain 8 asks how security is built into software from requirements to retirement. You are not expected to write code, but you should know where in the SDLC a control belongs, why fixing defects early is cheaper, and how to assess third-party and open-source components.
Sample Domain 8 questions
When is it MOST cost-effective to address security in a new application?
A web form passes user input directly into a SQL statement. Which control BEST prevents injection?
A team wants to identify known vulnerabilities in open-source libraries it uses. Which tool category fits?
Common Domain 8 traps
- Adding security at testing rather than at requirements and design.
- Assuming input validation on the client side is sufficient.
- Ignoring supply chain risk from libraries and dependencies.
Key concepts to master
- Secure SDLC, DevSecOps, threat modelling
- OWASP Top 10: injection, broken access control, XSS
- Maturity models: CMMI, SAMM
- SAST, DAST, SCA, code signing
- Database security, APIs and acquired software
Need the theory first? Read the CISSP Domain 8 study guide.
Find out where you stand
Start with the free 10-question CISSP practice test — no signup. Then create a free account for Practice Mode, or go Pro for Domain Quick-Fire, CAT-style adaptive exams and readiness analytics.