CISSP.app Daily QuestionsFree DiagnosticPricing
Software Development SecurityEasy

CISSP Practice Question: In a software development firm, the security team is conducting a code…

Published September 9, 2026 · Free daily CISSP practice question
In a software development firm, the security team is conducting a code review for a newly developed application. During the review, they identify a potential backdoor that could be exploited by malicious actors. What is the MOST appropriate action the security team should take in this situation?
  1. A.A. Implement an Intrusion Detection System (IDS) to monitor for any suspicious activity related to the backdoor.
  2. B.B. Document the backdoor as a low priority issue and proceed with the application deployment as scheduled.
  3. C.C. Notify the development team about the backdoor and work together to fix the issue before deploying the application.
  4. D.D. Ignore the backdoor since it has not been exploited yet and focus on other security measures.
Correct answer: C. C. Notify the development team about the backdoor and work together to fix the issue before deploying the application.

Correct Answer: C. Notify the development team about the backdoor and work together to fix the issue before deploying the application.

Explanation (CISSP Manager Logic):

Security managers must prioritize proactive risk mitigation by addressing vulnerabilities at the source before they reach production. Remediating flaws during the development phase is the most cost-effective way to ensure software integrity and fulfill due care obligations.

By collaborating with development, you:

  • Reduce remediation costs by fixing bugs before deployment.
  • Foster a DevSecOps culture of shared security responsibility.
  • Ensure the application meets security baselines before release.

While the other options are relevant, they fall short because:

  • A: An IDS is a detective control that monitors risk rather than removing the underlying threat.
  • B: Backdoors represent critical security failures and should never be classified as low priority.
  • D: Ignoring known vulnerabilities violates the principle of due care and increases organizational liability.

Think like a manager:

Practice "security by design" by shifting security left in the lifecycle to mitigate risks at the source rather than relying on perimeter defenses.

Ready to find out if you'd pass?

5,000+ expert-calibrated questions, adaptive CAT mock exams, and gap analysis that shows exactly what to study next.

Try 5 free questions Start 7-day free trial
← Previous question All questions