CDP Secure Software Development Lifecycle Flashcards

Which phase of the Secure SDLC is MOST critical for identifying security requirements before any code is written?

Answer: Requirements/Design

Security requirements must be defined during the Requirements/Design phase so that security controls are built in from the start rather than bolted on later.

What is the primary purpose of threat modeling in the Secure SDLC?

Answer: Identify and prioritize potential threats early in design

Threat modeling proactively identifies potential attack vectors and prioritizes mitigations during the design phase, reducing remediation cost.

Which tool category performs Static Application Security Testing (SAST)?

Answer: Source code analyzers

SAST tools analyze source code or compiled binaries without executing the application to detect security flaws.

Dynamic Application Security Testing (DAST) differs from SAST because it:

Answer: Tests the running application by sending crafted requests

DAST interacts with a live, running application to discover runtime vulnerabilities such as injection flaws and authentication issues.

A 'security gate' in a CI/CD pipeline is designed to:

Answer: Block promotion of code that fails security checks

Security gates enforce policy by automatically halting the pipeline when vulnerability thresholds or compliance checks are not met.

Software Composition Analysis (SCA) is primarily used to:

Answer: Identify vulnerabilities in open-source and third-party dependencies

SCA scans project dependencies against vulnerability databases to flag known CVEs in open-source libraries.