CDP CDP Secure Software Development Lifecycle 2

Question 1

Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?

Accepted Answer

OWASP SAMM (Software Assurance Maturity Model)

Answer

OWASP SAMM defines measurable maturity levels across security practices to help organizations improve their Secure SDLC systematically.

Question 2

In secure coding, what does 'input validation' primarily protect against?

Accepted Answer

Injection attacks such as SQL injection and XSS

Answer

Validating and sanitizing user input prevents malicious data from being interpreted as commands, blocking injection-class vulnerabilities.

Question 3

The principle of 'least privilege' in application development means:

Accepted Answer

Each component runs with only the permissions it needs to function

Answer

Least privilege limits the blast radius of a compromise by ensuring components cannot access resources beyond their functional requirements.

Question 4

Secrets management in the SDLC ensures that:

Accepted Answer

API keys and credentials are never hardcoded in source code

Answer

Hardcoded credentials in source code are easily leaked via version control; secrets should be stored in dedicated vaults and injected at runtime.

Question 5

A 'shift-left' security approach in DevSecOps means:

Accepted Answer

Moving security testing earlier in the development lifecycle

Answer

Shifting left integrates security checks at the earliest possible stages (design, code, build) rather than only at the end of the cycle.

(CDP) Certified DevSecOps Professional Practice Test