Domain 8 covers building security into software from the start: secure SDLC models, common application vulnerabilities (much of it overlapping with OWASP Top 10 concepts), database security, and secure coding practices. At 10% weight it's the smallest domain, but candidates without a development background sometimes underestimate how much conceptual (not coding) knowledge it actually requires.
Secure SDLC models
Waterfall (sequential, security often bolted on late) vs. Agile (iterative) vs. DevSecOps (security integrated continuously into CI/CD). Know that "shifting left" means moving security activities earlier in the lifecycle, not just adding more of them at the end.
Injection vulnerabilities
SQL injection, command injection, and LDAP injection all stem from the same root cause: untrusted input concatenated directly into a command/query instead of being properly parameterized or validated.
OWASP Top 10 concepts
Broken access control, cryptographic failures, injection, and insecure design: the exam draws on these categories without necessarily naming "OWASP" directly, so know the underlying vulnerability classes, not just the branded list.
Database security
Views, stored procedures, and parameterized queries as defenses. Understand aggregation (combining non-sensitive data to infer sensitive conclusions) and inference attacks as database-specific confidentiality risks distinct from the network-layer attacks covered in Domain 4.
Software escrow
Source code held by a neutral third party, released to a customer if a software vendor goes out of business or fails to maintain the product: a contractual risk-mitigation tool that shows up in vendor/procurement contexts.
Input validation vs. sanitization vs. encoding
Validation rejects input that doesn't match the expected format/type. Sanitization strips or modifies dangerous input to make it safe. Output encoding transforms data so it's rendered literally rather than executed (the actual defense against stored/reflected XSS). These are complementary, not interchangeable, defenses.
Aggregation vs. inference (database security)
Aggregation is combining multiple pieces of low-sensitivity data to derive a high-sensitivity conclusion the user wasn't directly authorized to see. Inference is deducing sensitive information indirectly from patterns in data the user was authorized to see, without ever combining separate records.
Practice D8 questions with instant feedback, free to start, no card required.
Start Free