nerdexam
(ISC)2

CISSP · Question #1257

Which of the following should be included in a good defense-in-depth strategy provided by object- oriented programming for software deployment?

The correct answer is C. Encapsulation. Defense-in-depth in object-oriented programming relies on encapsulation to hide internal object data and restrict direct access, serving as a security layer within software design.

Submitted by zhang_li· Mar 5, 2026Software Development Security

Question

Which of the following should be included in a good defense-in-depth strategy provided by object- oriented programming for software deployment?

Options

  • APolyinstantiation
  • BPolymorphism
  • CEncapsulation
  • DInheritance

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    17% (4)
  • C
    70% (16)
  • D
    9% (2)

Why each option

Defense-in-depth in object-oriented programming relies on encapsulation to hide internal object data and restrict direct access, serving as a security layer within software design.

APolyinstantiation

Polyinstantiation is a database security concept that allows multiple rows with the same primary key at different classification levels to prevent inference attacks, and is not an object-oriented programming principle related to defense-in-depth.

BPolymorphism

Polymorphism allows objects of different types to be treated through a common interface and is primarily a design flexibility feature, not a security control that contributes to defense-in-depth.

CEncapsulationCorrect

Encapsulation bundles data and the methods that operate on that data within a class, hiding internal state from outside access and enforcing controlled interfaces. This data-hiding principle directly supports defense-in-depth by ensuring that internal implementation details are protected from unauthorized or unintended access. It acts as a security boundary within software, limiting the attack surface exposed by each object.

DInheritance

Inheritance allows a class to derive properties and behaviors from a parent class, which can actually introduce security risks by exposing inherited methods, making it a design reuse feature rather than a defense-in-depth mechanism.

Concept tested: Encapsulation as OOP security defense-in-depth principle

Source: https://www.cs.auckland.ac.nz/software/AgileAuckland/oop/oop1.html

Topics

#OOP security#encapsulation#defense-in-depth#software development security

Community Discussion

No community discussion yet for this question.

Full CISSP Practice