712-50 Question 313
Select 3Secure Coding Best Practices and Securing Web Applications (5 questions)A retail enterprise is preparing to launch a new customer-facing web application developed by multiple agile teams and several third-party contractors. During pre-production testing, the security team finds recurring SQL injection and cross-site scripting issues, inconsistent input validation across microservices, and delayed remediation because developers treat security findings as a separate audit activity. As the CCISO, you must recommend the most effective program-level actions to reduce these vulnerabilities before release and improve long-term resilience without significantly slowing delivery. Which THREE actions should you prioritize?
- A
Establish secure coding standards based on recognized guidance, require developer training on common web application flaws, and make those standards part of the software development lifecycle
- B
Integrate automated security testing such as SAST, dependency checking, and DAST into the CI/CD pipeline with risk-based gating for critical findings
- C
Rely primarily on a web application firewall in front of the application so the launch can proceed while development teams address vulnerabilities later
- D
Implement centralized server-side input validation, output encoding, and parameterized queries as required design patterns across services
- E
Postpone remediation of medium-risk flaws until the annual penetration test confirms which findings are exploitable
Show answer and explanation
Correct answers: A, B, D
Explanation
The best response combines governance, process integration, and technical secure-by-design patterns. Option 1 improves security culture and establishes consistent expectations across internal and third-party developers. Option 2 operationalizes those expectations by embedding security controls into the CI/CD pipeline, which aligns with DevSecOps practices and helps remediate issues early. Option 4 directly addresses the technical weaknesses identified in testing by enforcing proven controls for injection and XSS prevention. This approach is consistent with industry guidance including OWASP Top 10, OWASP Application Security Verification Standard (ASVS), OWASP Cheat Sheets for SQL Injection Prevention and XSS Prevention, and NIST SSDF (Secure Software Development Framework), which emphasize secure coding standards, developer education, automated testing, and integrating security throughout the SDLC rather than relying on perimeter defenses or periodic audit-only remediation.
- A. Correct.
Correct. This addresses the root cause at the organizational level by shifting security left and making secure coding an expected engineering practice rather than a late audit function. Recognized guidance such as the OWASP Top 10, OWASP ASVS, and CERT Secure Coding standards can be used to define required controls and coding patterns. Developer training is particularly important where multiple agile teams and contractors are involved, because inconsistent knowledge often leads to repeated flaws such as SQL injection and XSS.
- B. Correct.
Correct. Embedding automated testing into CI/CD helps detect vulnerabilities earlier, when remediation is faster and less expensive. SAST can identify insecure code patterns, dependency checking can uncover vulnerable third-party components, and DAST can detect runtime web application issues. Risk-based gating is appropriate because it balances release velocity with security by blocking builds only for agreed critical issues rather than treating every finding equally.
- C. Incorrect.
Incorrect. A web application firewall can provide compensating controls and may reduce exploit attempts, but it should not be the primary strategy for addressing known coding weaknesses. WAFs are limited against business-logic flaws, may be bypassed, and do not eliminate vulnerable code. Choosing this as the main response reflects a common misconception that perimeter controls can replace secure development practices.
- D. Correct.
Correct. The scenario specifically mentions inconsistent input validation across microservices and recurring SQL injection and XSS. Standardizing secure design patterns such as server-side validation, contextual output encoding, and parameterized queries directly mitigates these classes of vulnerabilities. This is stronger than relying on individual teams to implement ad hoc controls because it creates consistency across services and reduces developer error.
- E. Incorrect.
Incorrect. Delaying medium-risk remediation until an annual test is contrary to effective vulnerability management in modern development environments. Many medium findings become significant when chained together or exposed in high-value applications. Annual confirmation is too slow for agile release cycles and perpetuates the existing problem of treating security as a separate audit activity instead of a continuous process.