CDP CDP Secure Software Development Lifecycle

Question 1

Which phase of the Secure SDLC is MOST critical for identifying security requirements before any code is written?

Accepted Answer

Requirements/Design

Answer

Security requirements must be defined during the Requirements/Design phase so that security controls are built in from the start rather than bolted on later.

Question 2

What is the primary purpose of threat modeling in the Secure SDLC?

Accepted Answer

Identify and prioritize potential threats early in design

Answer

Threat modeling proactively identifies potential attack vectors and prioritizes mitigations during the design phase, reducing remediation cost.

Question 3

Which tool category performs Static Application Security Testing (SAST)?

Accepted Answer

Source code analyzers

Answer

SAST tools analyze source code or compiled binaries without executing the application to detect security flaws.

Question 4

Dynamic Application Security Testing (DAST) differs from SAST because it:

Accepted Answer

Tests the running application by sending crafted requests

Answer

DAST interacts with a live, running application to discover runtime vulnerabilities such as injection flaws and authentication issues.

Question 5

A 'security gate' in a CI/CD pipeline is designed to:

Accepted Answer

Block promotion of code that fails security checks

Answer

Security gates enforce policy by automatically halting the pipeline when vulnerability thresholds or compliance checks are not met.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP CDP Secure Software Development Lifecycle