Application Security & Development Flashcards

Which describes a 'spike' in the context of a security-related unknown?

Answer: A time-boxed investigation to reduce uncertainty, such as evaluating an authentication library

Spikes are time-boxed research activities to answer technical questions.

A continuous delivery pipeline should fail the build when:

Answer: A critical security test fails

Automated quality gates stop unsafe changes from progressing.

Which statement about security and the Definition of Done is most accurate?

Answer: Including security checks in the Definition of Done ensures every increment meets a baseline

A shared Definition of Done makes security part of each increment's quality bar.

A stakeholder asks the team to skip security testing to hit a deadline. What is the best servant-leader response?

Answer: Make the risk and trade-offs transparent and negotiate scope rather than quality

Agile leaders make trade-offs visible and prefer flexing scope over compromising quality.

Which technique helps teams quickly identify the highest security risks to address first?

Answer: Risk-based prioritization using probability and impact

Risk scoring by probability and impact guides backlog ordering.

What is the main purpose of a code review in the context of secure development?

Answer: To share knowledge and catch defects, including insecure patterns, before merging

Reviews spread knowledge and detect issues early.

Which approach best handles evolving security threats over a long-lived product?

Answer: Continuously monitoring, learning, and adapting through backlog refinement and regular updates

Threats change, so agile teams adapt continuously using feedback.