60 Practice Questions & Answers
During the requirements phase of secure software development, which activity is MOST critical for identifying security needs?
-
A
Assigning team members to specific coding tasks
-
B
Selecting the programming language that will be used for implementation
-
C
Conducting threat modeling to identify potential attack vectors and security requirements
✓ Correct
-
D
Determining the budget and timeline for the project
Explanation
Threat modeling during requirements phase is essential for identifying security needs and attack vectors before design begins. This proactive approach prevents costly security fixes later in the lifecycle.
What is the primary purpose of security architecture review in the design phase?
-
A
To verify that all team members understand the project timeline
-
B
To assign security clearances to development team members
-
C
To reduce development costs by eliminating unnecessary components
-
D
To evaluate the design for security flaws and ensure secure design principles are applied
✓ Correct
Explanation
Security architecture review examines the design to ensure it incorporates secure design principles and identifies potential security flaws before implementation. This is a critical control point in the SDLC.
Which of the following BEST describes the concept of 'secure by design'?
-
A
Performing penetration testing exclusively by external security vendors
-
B
Adding security features after the application is deployed to production
-
C
Incorporating security considerations into every phase of software development from inception
✓ Correct
-
D
Using only proprietary frameworks that guarantee security
Explanation
Secure by design means integrating security throughout the entire SDLC from requirements through maintenance, rather than treating it as an afterthought. This approach reduces vulnerabilities more effectively.
In the context of CSSLP, what is the primary objective of code review from a security perspective?
-
A
To ensure all developers follow the same naming conventions for variables
-
B
To measure the performance and efficiency of the compiled code
-
C
To document all changes made to the source code repository
-
D
To identify security vulnerabilities, coding errors, and deviations from secure coding standards
✓ Correct
Explanation
Security-focused code review identifies vulnerabilities, improper use of APIs, authentication flaws, and other security issues before code reaches production. This is a key verification control.
Which secure coding practice is MOST effective in preventing SQL injection attacks?
-
A
Implementing complex password requirements for all database users
-
B
Encrypting all data stored in the database with AES-256
-
C
Using input validation and parameterized queries (prepared statements)
✓ Correct
-
D
Running the database server on a non-standard port number
Explanation
Parameterized queries and input validation prevent SQL injection by treating user input as data rather than executable code. This is the primary defense mechanism against this attack class.
What role does a Security Champion play in an organization's secure SDLC program?
-
A
Replaces the need for formal security training programs
-
B
Makes final decisions on all architectural changes in the organization
-
C
Serves as the sole person responsible for all security testing activities
-
D
Acts as a bridge between development teams and security to promote secure coding practices and awareness
✓ Correct
Explanation
Security Champions are developers or team members who advocate for security practices within their teams, promote awareness, and facilitate communication between development and security functions.
During testing, which type of security test focuses on examining application behavior with malformed or unexpected inputs?
-
A
Static analysis
-
B
Penetration testing
-
C
Performance testing
-
D
Fuzzing
✓ Correct
Explanation
Fuzzing involves sending malformed, invalid, or random data to application inputs to discover how the application handles unexpected conditions and identify potential crashes or security flaws.
What is the primary advantage of using Static Application Security Testing (SAST) in the development process?
-
A
It provides real-time feedback on code security issues during development before code is compiled
✓ Correct
-
B
It eliminates the need for manual code review by developers
-
C
It can only be performed after the application is deployed to production
-
D
It requires the application to be running in order to detect vulnerabilities
Explanation
SAST analyzes source code without execution to identify vulnerabilities early in the development cycle, enabling developers to fix issues before they reach testing or production environments.
Which of the following BEST defines the principle of 'least privilege'?
-
A
Users should be granted all permissions necessary for their role plus additional permissions for future needs
-
B
Only senior security staff should have any system access whatsoever
-
C
Users should be granted only the minimum permissions necessary to perform their specific job functions
✓ Correct
-
D
All users in the same department should receive identical access permissions regardless of specific role
Explanation
Least privilege means granting users and processes only the minimum access required to perform their necessary functions, reducing the impact of compromise or misuse.
What is the purpose of a Software Bill of Materials (SBOM) in secure software development?
-
A
To schedule meetings between development and security teams
-
B
To track the number of developers assigned to each project
-
C
To provide a detailed inventory of all components, libraries, and dependencies used in an application
✓ Correct
-
D
To calculate the total development cost of a software project
Explanation
An SBOM documents all components and dependencies in software, enabling organizations to identify vulnerabilities in third-party components and manage supply chain security risks.
In the context of secure SDLC, what does 'defense in depth' mean?
-
A
Using only one highly sophisticated security control to protect critical assets
-
B
Focusing all security efforts on protecting the database layer exclusively
-
C
Implementing multiple layers of security controls throughout the application and infrastructure
✓ Correct
-
D
Deploying security controls only at the network perimeter
Explanation
Defense in depth employs multiple, redundant security controls at different layers so that if one control fails, others continue to provide protection against attacks.
Which activity BEST represents security validation testing in the context of SDLC?
-
A
Verifying that security controls are implemented as designed and function correctly under normal and adverse conditions
✓ Correct
-
B
Purchasing commercial security tools and installing them on developer workstations
-
C
Assigning security roles and responsibilities to team members
-
D
Documenting all security requirements in a spreadsheet for future reference
Explanation
Security validation testing confirms that implemented security controls work as intended and effectively mitigate identified threats and risks in real-world scenarios.
What is a primary concern when using open-source software in a secure SDLC program?
-
A
Open-source software cannot be modified for specific organizational needs
-
B
Open-source software is always more expensive than proprietary alternatives
-
C
Managing vulnerabilities in open-source components and understanding licensing compliance requirements
✓ Correct
-
D
All open-source projects have equal security maturity and support levels
Explanation
Organizations must track vulnerabilities in open-source dependencies, apply patches promptly, and ensure license compliance. Not all open-source projects have equivalent security practices or support.
How does secure coding training contribute to reducing vulnerabilities in the SDLC?
-
A
It allows developers to approve their own code for production release
-
B
It guarantees that no vulnerabilities will ever appear in the application code
-
C
It provides developers with knowledge of common vulnerability types and how to prevent them through proper coding techniques
✓ Correct
-
D
It eliminates the need for security testing and code review processes
Explanation
Security training educates developers about vulnerability classes (injection, XSS, etc.), secure coding practices, and how to use security APIs correctly, reducing vulnerability introduction at the source.
In a mature secure SDLC program, how should security metrics and measurements be used?
-
A
To identify trends, track improvement, and drive continuous enhancement of security practices and controls
✓ Correct
-
B
To measure only the number of security vulnerabilities found, not their severity
-
C
To reduce security spending when metrics show improvements
-
D
To assign blame when vulnerabilities are discovered in production
Explanation
Security metrics should track trends and improvements over time to guide decisions, allocate resources effectively, and demonstrate the value of security investments throughout the organization.
What is the primary purpose of a risk register in secure software development?
-
A
To document and track identified security risks, their likelihood, impact, and mitigation strategies throughout the project lifecycle
✓ Correct
-
B
To maintain a list of all software licenses owned by the organization
-
C
To list all employees and their assigned passwords for the development environment
-
D
To record the budget expenses for security tools and training
Explanation
A risk register systematically documents identified risks, assesses probability and impact, assigns owners, and tracks mitigation strategies, enabling proactive risk management throughout the SDLC.
Which approach BEST describes how to handle legacy applications in a secure SDLC framework?
-
A
Assume legacy applications are secure because they have been in production for many years
-
B
Implement security assessments, prioritize vulnerabilities, and incrementally remediate risks based on criticality and exposure
✓ Correct
-
C
Immediately replace all legacy applications with newly developed ones regardless of cost or functionality impact
-
D
Ignore legacy applications and focus only on new development projects
Explanation
Legacy applications should be assessed for security, vulnerabilities prioritized by risk, and remediation planned strategically based on business impact and resources available.
What is a critical security consideration when implementing API integrations in modern applications?
-
A
API security is less important than web application security due to restricted access
-
B
APIs should expose all available functionality without any access restrictions
-
C
APIs should never validate input from external sources since they are internal to the application
-
D
Implementing proper authentication, authorization, rate limiting, and input validation for API endpoints
✓ Correct
Explanation
APIs must implement robust security controls including authentication, authorization, input validation, and rate limiting to prevent unauthorized access, data exposure, and abuse of API functionality.
In the context of security incident response within SDLC, what should organizations establish?
-
A
A policy prohibiting developers from discussing security incidents with anyone
-
B
A requirement that all incidents must result in immediate termination of involved employees
-
C
A process to hide security incidents from customers and regulatory bodies
-
D
A comprehensive incident response plan with defined roles, communication procedures, and post-incident review processes
✓ Correct
Explanation
Organizations need documented incident response procedures including detection, containment, eradication, recovery, and post-incident analysis to minimize damage and improve security processes.
How does data classification contribute to secure application development?
-
A
It enables developers to understand what data requires protection, implementing appropriate security controls based on sensitivity levels
✓ Correct
-
B
It applies only to data stored in databases, not data processed by applications
-
C
It eliminates the need for encryption since classified data doesn't need additional protection
-
D
It is only relevant for security personnel and not applicable to developers
Explanation
Data classification guides security implementation by identifying what information requires protection, the appropriate controls needed, and handling requirements throughout the application lifecycle.
What is a key objective of security regression testing in the SDLC?
-
A
To ensure that previously identified and fixed vulnerabilities have not been reintroduced by recent code changes or updates
✓ Correct
-
B
To prevent developers from making any modifications to production code
-
C
To measure the performance degradation of security controls over time
-
D
To identify and remove all security controls that are no longer in use
Explanation
Security regression testing validates that security fixes remain effective and that recent code modifications haven't inadvertently reintroduced previously resolved vulnerabilities.
Which secure development practice BEST addresses the risk of insecure deserialization vulnerabilities?
-
A
Serializing all application data using a homemade encryption algorithm
-
B
Disabling all input validation to allow flexible data processing
-
C
Validating and sanitizing all serialized data, using secure deserialization methods, and avoiding deserialization of untrusted data when possible
✓ Correct
-
D
Using only the default deserialization libraries provided by programming languages without modification
Explanation
Insecure deserialization is prevented by validating serialized data before processing, using secure deserialization libraries, and avoiding deserialization of untrusted external data.
In secure SDLC, how should security requirements be prioritized when they conflict with functional requirements?
-
A
Security requirements should never be questioned and must always take absolute priority
-
B
Always eliminate security requirements in favor of delivering features faster
-
C
Defer all security requirements to be addressed in a separate project after release
-
D
Consider business context, risk tolerance, and compliance obligations to make informed trade-off decisions through cross-functional review
✓ Correct
Explanation
Security and functional requirements must be balanced by considering business risk, compliance needs, and organizational risk appetite through collaborative decision-making involving development, security, and business stakeholders.
What is the significance of threat modeling in the design phase of SDLC?
-
A
It provides a structured approach to identifying potential threats, attack vectors, and vulnerabilities before implementation begins
✓ Correct
-
B
It replaces the need for actual security testing throughout the development process
-
C
It should only be conducted after the application is deployed to production
-
D
It is a documentation exercise with no practical application to development
Explanation
Threat modeling systematically identifies potential attacks and vulnerabilities during design, enabling developers to implement appropriate mitigating controls early and cost-effectively.
Which of the following BEST represents a secure approach to managing secrets in applications (API keys, passwords, tokens)?
-
A
Using environment variables, secure vaults, or configuration management systems to separate secrets from code
✓ Correct
-
B
Hardcoding secrets directly into source code for easy access by all developers
-
C
Printing secrets to application logs for debugging and troubleshooting purposes
-
D
Storing all secrets in plain text configuration files in the version control repository
Explanation
Secrets must be stored in secure vaults or configuration systems outside source code and version control to prevent exposure if repositories are compromised or accessed by unauthorized users.
Which of the following best describes the primary goal of secure software development lifecycle (SDLC) practices?
-
A
To reduce development costs by implementing security early
-
B
To eliminate all possible vulnerabilities before release
-
C
To comply with industry regulations only
-
D
To integrate security considerations throughout all phases of software development rather than as an afterthought
✓ Correct
Explanation
The primary goal of secure SDLC is to embed security throughout the entire development process, from planning through maintenance, rather than treating it as a separate concern added at the end. While this may help with compliance and cost, the core objective is integration throughout all phases.
During the requirements phase of secure software development, which activity is most critical for establishing a security baseline?
-
A
Conducting threat modeling to identify potential security risks
✓ Correct
-
B
Selecting the most expensive security tools available
-
C
Writing detailed code comments about security concerns
-
D
Scheduling regular penetration testing sessions
Explanation
Threat modeling during the requirements phase helps identify potential attacks and security risks early, allowing security requirements to be properly documented and understood before development begins. This establishes a foundation for all subsequent security activities.
What is the primary purpose of security requirements in the SDLC?
-
A
To document all known vulnerabilities in similar applications
-
B
To serve as a checklist for the security team to verify compliance after deployment
-
C
To define the budget allocated to security testing
-
D
To establish clear, measurable security objectives that guide design, development, and testing activities
✓ Correct
Explanation
Security requirements define what the software must accomplish from a security perspective and serve as criteria against which the final product is evaluated. These requirements guide all subsequent development activities and help ensure consistent security implementation.
In secure design principles, which concept refers to granting users only the minimum necessary permissions to perform their job functions?
-
A
Security through obscurity
-
B
Defense in depth
-
C
Separation of duties
-
D
Principle of least privilege
✓ Correct
Explanation
The principle of least privilege ensures that users, applications, and systems have only the minimum access rights needed to function, reducing the potential impact of compromised accounts or malicious actions. This is a fundamental security design principle.
Which of the following is the most effective approach to managing third-party and open-source components in secure software development?
-
A
Only updating components when critical vulnerabilities are publicly disclosed
-
B
Implementing a systematic process to identify, evaluate, and monitor all third-party dependencies for security vulnerabilities
✓ Correct
-
C
Avoiding all open-source software to eliminate supply chain risks
-
D
Using components without verification since they are already publicly available
Explanation
A systematic approach to managing third-party and open-source components includes identifying what is used, evaluating their security posture, tracking vulnerabilities, and maintaining them proactively. This reduces supply chain risk while allowing the benefits of reusable components.
What is the primary advantage of conducting code review as a security activity?
-
A
It speeds up the development process by avoiding formal testing
-
B
It allows human reviewers to identify security issues, architectural flaws, and design problems that automated tools may miss
✓ Correct
-
C
It eliminates the need for static analysis tools
-
D
It guarantees that no vulnerabilities will exist in the code
Explanation
Code review, especially security-focused peer review, leverages human judgment to identify complex security issues, logic flaws, and design problems that automated scanning tools might miss. It complements rather than replaces automated analysis.
In the context of secure coding, what does input validation primarily protect against?
-
A
Injection attacks, buffer overflows, and other exploits that rely on malformed or malicious input
✓ Correct
-
B
Legitimate users forgetting their passwords
-
C
Slow network connections and performance degradation
-
D
Database server outages and system failures
Explanation
Input validation is a critical defensive technique that ensures data entering an application conforms to expected formats and values, protecting against injection attacks, buffer overflows, cross-site scripting, and other input-based attacks.
Which secure coding practice involves ensuring that sensitive data is not transmitted in plain text across networks?
-
A
Implementation of encryption and secure communication protocols like TLS/SSL
✓ Correct
-
B
Proper error handling and logging
-
C
Regular security patching and updates
-
D
User education and security awareness training
Explanation
Encrypting data in transit using protocols like TLS/SSL ensures that sensitive information cannot be intercepted and read by attackers on the network. This is a fundamental secure coding practice for protecting confidentiality.
What is the primary purpose of security testing in the software development lifecycle?
-
A
To train developers on secure coding techniques
-
B
To identify and verify the remediation of security vulnerabilities before the software reaches production
✓ Correct
-
C
To demonstrate compliance with coding standards
-
D
To document all features implemented in the application
Explanation
Security testing is designed to uncover vulnerabilities and weaknesses in the software and verify that security controls function as intended. It provides evidence that security requirements have been met before production deployment.
Which testing methodology involves examining an application's functionality without access to its source code or internal implementation details?
-
A
Black-box testing
✓ Correct
-
B
Gray-box testing
-
C
White-box testing
-
D
Unit testing
Explanation
Black-box testing treats the application as an opaque system, examining inputs and outputs without knowledge of internal structure. This approach simulates an attacker's perspective and is valuable for finding vulnerabilities in exposed functionality.
In secure software deployment, what is the primary benefit of implementing a staged rollout or canary deployment strategy?
-
A
It reduces the impact of potential security issues by deploying to a subset of users first, allowing identification of problems before full deployment
✓ Correct
-
B
It eliminates the need for security testing before release
-
C
It guarantees that all users will receive updates simultaneously
-
D
It removes the responsibility of security from the operations team
Explanation
Staged rollouts deploy changes to a limited audience first, allowing teams to detect and respond to security issues or functionality problems before they affect all users. This approach limits the blast radius of potential incidents.
Which of the following is the most important aspect of secure configuration management for deployed software?
-
A
Avoiding security patches to maintain system stability
-
B
Storing configuration files in publicly accessible directories for easy access
-
C
Using the same password for all administrative accounts to simplify management
-
D
Maintaining detailed documentation of all configuration changes and ensuring only authorized personnel can modify configurations
✓ Correct
Explanation
Secure configuration management requires strict access controls, change tracking, and documentation to prevent unauthorized modifications that could introduce vulnerabilities. This ensures that the system remains in a known, secure state.
What is the primary goal of security patch management in the operational phase of the SDLC?
-
A
To delay all updates to ensure maximum stability of the system
-
B
To promptly identify, test, and deploy security updates to address known vulnerabilities and reduce the window of exposure
✓ Correct
-
C
To eliminate the need for penetration testing by keeping all patches current
-
D
To maintain current application features without any changes
Explanation
Patch management aims to minimize the time that systems remain vulnerable to known exploits by maintaining a process to identify, test, and deploy security patches efficiently. This is critical for ongoing security in production environments.
Which activity best represents the security considerations for legacy application maintenance and updates?
-
A
Only patching legacy systems when they completely fail
-
B
Ignoring legacy applications since they will eventually be replaced
-
C
Applying the same security requirements and testing practices as new applications while considering compatibility constraints and end-of-life planning
✓ Correct
-
D
Removing all authentication mechanisms to simplify legacy system administration
Explanation
Legacy applications require security attention balanced with compatibility and maintenance constraints. Organizations must apply appropriate security practices, plan for end-of-life, and manage the transition to replacement systems while keeping legacy systems secure.
In the context of cryptographic security, what is the primary distinction between symmetric and asymmetric encryption?
-
A
Asymmetric encryption is always more secure than symmetric encryption regardless of key length
-
B
Symmetric encryption is faster but requires secure key exchange, while asymmetric encryption uses two mathematically related keys for encryption and decryption
✓ Correct
-
C
Symmetric encryption uses public keys while asymmetric uses private keys
-
D
There is no meaningful difference between symmetric and asymmetric encryption in practical applications
Explanation
Symmetric encryption uses a single shared key for both encryption and decryption (faster but requires secure key exchange), while asymmetric encryption uses a public key and private key pair. Asymmetric is slower but solves the key distribution problem.
What is the primary security risk associated with weak or default credentials in software applications?
-
A
It provides attackers with easily exploitable entry points to gain unauthorized access to systems and sensitive data
✓ Correct
-
B
It increases the cost of software licensing and maintenance
-
C
It reduces the speed of user authentication slightly
-
D
It causes the application to consume more network bandwidth
Explanation
Weak or default credentials are among the easiest vulnerabilities for attackers to exploit, allowing unauthorized access. Organizations must enforce strong password policies and eliminate default credentials before deployment.
Which of the following best describes the role of static application security testing (SAST) in the secure SDLC?
-
A
It replaces the need for code review and manual security analysis
-
B
It only identifies vulnerabilities in test environments after deployment
-
C
It monitors user behavior to detect security incidents in production systems
-
D
It analyzes source code and compiled binaries to identify potential security vulnerabilities without executing the program
✓ Correct
Explanation
SAST tools examine source code and binaries statically to identify security issues early in development. This allows vulnerabilities to be found and fixed before the code reaches runtime, complementing other testing approaches.
What is the primary objective of dynamic application security testing (DAST) in the software development lifecycle?
-
A
To perform static analysis of configuration files only
-
B
To document all user features and functionality without any security focus
-
C
To examine source code for programming errors unrelated to security
-
D
To analyze running applications and identify security vulnerabilities that manifest during execution, including those in deployed environments
✓ Correct
Explanation
DAST tools test running applications to identify runtime security vulnerabilities, including issues with how the application handles requests, manages sessions, and protects data in motion. This complements SAST by finding issues not visible in static analysis.
In secure software architecture, what is the primary benefit of implementing defense in depth?
-
A
It guarantees that no attacks will ever succeed against the system
-
B
It eliminates the need for any single security control to be perfectly effective
-
C
It simplifies security management by consolidating all controls into a single location
-
D
It uses multiple layered security controls so that if one control is bypassed, additional controls still protect the system
✓ Correct
Explanation
Defense in depth implements multiple overlapping security controls at different layers (network, application, data, etc.). This strategy ensures that even if one control is compromised, additional controls continue to protect against attacks.
Which of the following represents a critical control for preventing unauthorized access to sensitive data in applications?
-
A
Using the same user role for all application users to simplify administration
-
B
Storing passwords in plain text for easy user recovery
-
C
Implementing robust authentication and authorization mechanisms that verify user identity and enforce appropriate access controls
✓ Correct
-
D
Disabling all logging to improve application performance
Explanation
Strong authentication verifies that users are who they claim to be, while proper authorization ensures users can only access resources appropriate to their role. Together, these controls are fundamental to preventing unauthorized data access.
What is the primary purpose of security metrics and measurement in the secure SDLC?
-
A
To track and assess the effectiveness of security activities, identify trends, and support continuous improvement of the security program
✓ Correct
-
B
To reduce the number of developers working on software projects
-
C
To increase the overall cost of software development projects
-
D
To eliminate all possibility of security vulnerabilities in applications
Explanation
Security metrics provide visibility into the security posture of applications and the effectiveness of security controls. Data from metrics helps organizations identify improvement areas, track progress, and make risk-based decisions.
In the context of secure software development, what does secure by design mean?
-
A
Employing security consultants exclusively for documentation purposes
-
B
Using only the most complex security algorithms available
-
C
Adding security features after the application is fully developed and ready for release
-
D
Integrating security considerations into the application architecture and design from the beginning of development
✓ Correct
Explanation
Secure by design means that security is considered from the earliest stages of system design and architecture, rather than being added later. This approach results in more effective and efficient security implementations.
Which of the following best describes the relationship between security architecture and secure coding practices?
-
A
Secure coding and security architecture are unrelated and should be managed by completely separate teams
-
B
Security architecture replaces the need for secure coding since the design handles all security concerns
-
C
Secure coding is only relevant to the testing phase while architecture is only relevant to design
-
D
Security architecture provides the framework and design principles that guide secure coding implementation and development practices
✓ Correct
Explanation
Security architecture establishes the overall security design, threat model, and principles that guide development. Secure coding practices then implement these architectural principles at the code level, creating a cohesive security approach.
What is the primary risk of using unverified or untrusted sources for software components in application development?
-
A
It eliminates the need for security testing since external components are already vetted
-
B
It improves development speed without any potential drawbacks
-
C
It may introduce malware, backdoors, or vulnerabilities into the application through compromised or malicious components
✓ Correct
-
D
It always reduces the functionality of the final application
Explanation
Using untrusted component sources introduces supply chain risks, potentially including malware, vulnerabilities, or backdoors. Organizations must verify the source, integrity, and security posture of all third-party components before integration.
In secure incident response planning for software systems, which element is most critical for minimizing damage from a security breach?
-
A
Having a pre-developed, tested incident response plan with defined roles, communication procedures, and recovery steps
✓ Correct
-
B
Assuming that security breaches will never occur in well-designed systems
-
C
Responding only after all stakeholders have been notified of the incident
-
D
Waiting until an incident occurs before developing any response procedures
Explanation
Pre-developed incident response plans enable organizations to respond quickly and effectively when breaches occur, reducing the time attackers have access to systems and minimizing overall impact. Plans must be regularly tested and updated.
During the secure software development lifecycle, which phase is primarily responsible for establishing security requirements and acceptance criteria?
-
A
Requirements definition and analysis
✓ Correct
-
B
Deployment and maintenance
-
C
Architecture and design review
-
D
Implementation and coding
Explanation
Security requirements must be defined early in the SDLC to ensure all stakeholders understand what constitutes secure functionality. This occurs during the requirements definition phase where acceptance criteria are also established.
What is the primary purpose of threat modeling in secure software development?
-
A
To identify and prioritize security threats so that appropriate mitigations can be designed
✓ Correct
-
B
To document all potential security threats and vulnerabilities before implementation begins
-
C
To establish audit trails for compliance with regulatory frameworks
-
D
To create a list of all assets that require protection from external attackers
Explanation
Threat modeling is a structured approach to identifying, enumerating, and prioritizing potential security threats, enabling architects and developers to design appropriate security controls and mitigations proactively.
Which of the following best describes the concept of 'least privilege' in the context of secure software design?
-
A
Privilege escalation should be prevented through network segmentation alone
-
B
Users should have administrative access to all system resources without restriction
-
C
Every user, process, and system component should have only the minimum permissions necessary to perform its intended function
✓ Correct
-
D
Security privileges should be granted based on organizational hierarchy rather than functional need
Explanation
Least privilege is a fundamental security principle requiring that users and processes be granted only the minimum necessary permissions to accomplish their tasks, reducing the attack surface and limiting potential damage from compromised accounts.
In secure code review practices, what is a primary advantage of using automated static analysis tools compared to manual code review?
-
A
Automated tools require no ongoing maintenance or updates to detection rules and signatures
-
B
Manual code review is completely obsolete when automated scanning tools are properly configured
-
C
Automated tools can identify all logic errors and business requirement violations without human oversight
-
D
Automated tools provide consistent, repeatable scanning that can detect known vulnerability patterns quickly across large codebases
✓ Correct
Explanation
Automated static analysis tools excel at finding known patterns of security vulnerabilities consistently and quickly, though they must be complemented by manual review for logic flaws and business context understanding.
Which secure development practice is most critical for preventing SQL injection vulnerabilities in web applications?
-
A
Using parameterized queries or prepared statements to separate code from data
✓ Correct
-
B
Storing all database credentials in encrypted configuration files only
-
C
Restricting database access to read-only permissions for all application accounts
-
D
Implementing Web Application Firewalls (WAF) to block all database queries
Explanation
Parameterized queries treat user input as data rather than executable code, preventing attackers from injecting malicious SQL commands. This is the most effective prevention technique at the source code level.
What is the primary objective of security testing and validation in the SDLC?
-
A
To ensure that all third-party dependencies have valid licenses and support contracts
-
B
To verify that security requirements have been implemented correctly and that known attack vectors are mitigated
✓ Correct
-
C
To measure code complexity metrics and refactor for better performance optimization
-
D
To document all discovered vulnerabilities for archival purposes only
Explanation
Security testing validates that security controls function as designed and that the application adequately protects against identified threats, ensuring security requirements are met before release.
In the context of secure software development, what does 'defense in depth' mean?
-
A
Creating security defenses that are psychologically deep and difficult for users to understand
-
B
Designing security around a single critical control point that must never fail
-
C
Implementing multiple layers of security controls so that if one fails, others remain effective
✓ Correct
-
D
Developing security features that only apply to the deepest network layers
Explanation
Defense in depth is a layered security strategy where multiple independent controls are implemented at different levels, ensuring that compromise of one control does not result in complete system compromise.
Which approach best addresses the secure handling of sensitive data during software development and testing?
-
A
Storing sensitive data in plaintext in development databases for easier debugging and troubleshooting
-
B
Relying entirely on physical security measures to protect development environments from unauthorized access
-
C
Using actual production data for all development and testing environments to ensure realistic scenarios
-
D
Implementing data masking, tokenization, or synthetic data generation for non-production environments
✓ Correct
Explanation
Using masked, tokenized, or synthetic data in development and test environments protects sensitive information while still allowing realistic testing, reducing exposure risk without compromising data quality.
What is a primary consideration when integrating third-party components or libraries into secure software development?
-
A
Assuming all open-source components are inherently more secure than proprietary alternatives due to community review
-
B
Third-party components always have vulnerabilities and should never be used in production applications
-
C
Using only the oldest and most established third-party libraries because they have fewer unknown vulnerabilities
-
D
Performing security assessment of components, tracking dependencies, and maintaining awareness of disclosed vulnerabilities
✓ Correct
Explanation
Organizations must assess third-party components for security, maintain accurate inventories of dependencies, subscribe to vulnerability notifications, and have processes to update or patch vulnerable components promptly.
In secure software development, what is the primary goal of implementing secure coding standards and guidelines?
-
A
To replace architectural security controls with coding-level defenses throughout the application
-
B
To establish consistent practices that prevent common vulnerability classes and reduce security defects introduced during development
✓ Correct
-
C
To eliminate the need for security testing later in the development lifecycle
-
D
To ensure that all developers have identical programming styles regardless of their experience level
Explanation
Secure coding standards and guidelines establish best practices for developers to avoid common vulnerabilities and weaknesses, reducing the number of security defects that must be remediated through testing and fixes.