CDP CDP Secure Software Development Lifecycle 1 — Questions and Answers
Question 1: Which phase of the Secure SDLC is MOST critical for identifying security requirements before any code is written?
- Testing
- Requirements/Design (Correct answer)
- Deployment
- Maintenance
Correct answer: Requirements/Design
Security requirements must be defined during the Requirements/Design phase so that security controls are built in from the start rather than bolted on later.
Question 2: What is the primary purpose of threat modeling in the Secure SDLC?
- Automate code deployment
- Identify and prioritize potential threats early in design (Correct answer)
- Monitor production systems
- Patch vulnerabilities after release
Correct answer: Identify and prioritize potential threats early in design
Threat modeling proactively identifies potential attack vectors and prioritizes mitigations during the design phase, reducing remediation cost.
Question 3: Which tool category performs Static Application Security Testing (SAST)?
- Runtime monitoring agents
- Source code analyzers (Correct answer)
- Network scanners
- Penetration testing frameworks
Correct answer: Source code analyzers
SAST tools analyze source code or compiled binaries without executing the application to detect security flaws.
Question 4: Dynamic Application Security Testing (DAST) differs from SAST because it:
- Scans infrastructure configurations
- Tests the running application by sending crafted requests (Correct answer)
- Reviews developer commit history
- Checks software licenses
Correct answer: Tests the running application by sending crafted requests
DAST interacts with a live, running application to discover runtime vulnerabilities such as injection flaws and authentication issues.
Question 5: A 'security gate' in a CI/CD pipeline is designed to:
- Speed up build times
- Block promotion of code that fails security checks (Correct answer)
- Notify developers of new features
- Archive build artifacts
Correct answer: Block promotion of code that fails security checks
Security gates enforce policy by automatically halting the pipeline when vulnerability thresholds or compliance checks are not met.
Question 6: Software Composition Analysis (SCA) is primarily used to:
- Test API endpoints for injection
- Identify vulnerabilities in open-source and third-party dependencies (Correct answer)
- Monitor user behavior at runtime
- Encrypt data at rest
Correct answer: Identify vulnerabilities in open-source and third-party dependencies
SCA scans project dependencies against vulnerability databases to flag known CVEs in open-source libraries.
CDP CDP Secure Software Development Lifecycle 1
Which phase of the Secure SDLC is MOST critical for identifying security requirements before any code is written?