CDP CDP Secure Software Development Lifecycle 2 — Questions and Answers
Question 1: Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?
- OWASP Top 10
- OWASP SAMM (Software Assurance Maturity Model) (Correct answer)
- OWASP ZAP
- OWASP Juice Shop
Correct answer: OWASP SAMM (Software Assurance Maturity Model)
OWASP SAMM defines measurable maturity levels across security practices to help organizations improve their Secure SDLC systematically.
Question 2: In secure coding, what does 'input validation' primarily protect against?
- Slow build pipelines
- Injection attacks such as SQL injection and XSS (Correct answer)
- Unauthorized binary deployments
- Certificate expiration
Correct answer: Injection attacks such as SQL injection and XSS
Validating and sanitizing user input prevents malicious data from being interpreted as commands, blocking injection-class vulnerabilities.
Question 3: The principle of 'least privilege' in application development means:
- Giving developers root access for faster debugging
- Each component runs with only the permissions it needs to function (Correct answer)
- Disabling all logging to minimize data exposure
- Requiring manual approval for every code commit
Correct answer: Each component runs with only the permissions it needs to function
Least privilege limits the blast radius of a compromise by ensuring components cannot access resources beyond their functional requirements.
Question 4: Secrets management in the SDLC ensures that:
- API keys and credentials are never hardcoded in source code (Correct answer)
- All source files are encrypted at rest on developer laptops
- Unit tests run faster in CI pipelines
- Feature flags are toggled automatically
Correct answer: API keys and credentials are never hardcoded in source code
Hardcoded credentials in source code are easily leaked via version control; secrets should be stored in dedicated vaults and injected at runtime.
Question 5: A 'shift-left' security approach in DevSecOps means:
- Moving security testing earlier in the development lifecycle (Correct answer)
- Deploying security patches to production first
- Left-aligning security dashboards in the UI
- Shifting firewall rules to the left network segment
Correct answer: Moving security testing earlier in the development lifecycle
Shifting left integrates security checks at the earliest possible stages (design, code, build) rather than only at the end of the cycle.
Question 6: Which practice helps developers find and fix security issues before code is merged?
- Post-production pen testing
- Security-focused code review (peer review) (Correct answer)
- Disabling branch protection rules
- Using only private repositories
Correct answer: Security-focused code review (peer review)
Security-focused code review catches flaws such as logic errors and insecure patterns before they are merged into the main branch.
CDP CDP Secure Software Development Lifecycle 2
Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?