Practice Test Geeks(SDL) Security Development Lifecycle Certification Practice Test
← All SDL Flashcard Decks

Compliance & Governance in SDLC Flashcards

7 cards from real SDL practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Compliance & Governance in SDLC flashcards as text

  1. Under HIPAA, which SDL phase is most critical for ensuring Protected Health Information (PHI) is handled securely in software?

    Answer: Requirements

    The Requirements phase is most critical because HIPAA compliance obligations — such as access controls and audit logging for PHI — must be identified and embedded before design begins.

  2. A governance board requires all third-party libraries to be approved before use. Which SDL artifact formally tracks this approval?

    Answer: Software Bill of Materials (SBOM)

    An SBOM inventories all third-party components and their approval status, making it the primary artifact for governing open-source and third-party library usage.

  3. PCI DSS Requirement 6 mandates secure software development. Which SDL practice most directly satisfies this requirement?

    Answer: Formal code review with security criteria

    PCI DSS Requirement 6 specifically calls for secure coding guidelines and code reviews that check for security vulnerabilities.

  4. Which regulatory framework specifically requires organizations to conduct a Data Protection Impact Assessment (DPIA) before processing high-risk personal data?

    Answer: GDPR

    GDPR Article 35 mandates DPIAs for processing activities that are likely to result in a high risk to individuals' rights and freedoms.

  5. An organization subject to FISMA must ensure its software development aligns with which publication for security controls?

    Answer: NIST SP 800-53

    FISMA requires federal agencies and their contractors to implement security controls defined in NIST SP 800-53.

  6. In SDL governance, what is the purpose of a Security Gate Review before the Design phase begins?

    Answer: To verify security requirements are complete before architecture decisions are made

    A pre-Design Security Gate ensures security requirements are fully defined so architects can build them into the system design rather than retrofitting later.

  7. SOX compliance in software development primarily concerns which aspect of the SDL?

    Answer: Change control and audit trails for financial application code

    SOX Section 404 requires verifiable change management controls and audit trails for systems affecting financial reporting.

How this page was made: written with AI tools. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy