Security Testing & Code Analysis Flashcards

Which metric produced by static analysis tools indicates the proportion of code paths exercised during testing?

Answer: Code coverage

Code coverage measures the percentage of statements, branches, or paths executed by a test suite, helping identify untested and potentially vulnerable code.

In SDL, 'red team' exercises are primarily intended to:

Answer: Simulate real adversary tactics to find exploitable weaknesses before attackers do

Red team exercises employ adversarial thinking and techniques to identify vulnerabilities and attack chains that traditional testing may miss.

Which of the following is a key advantage of integrating SAST tools into a CI/CD pipeline?

Answer: Provides immediate feedback to developers on security issues as code is committed

Integrating SAST into CI/CD enables shift-left security by alerting developers to potential vulnerabilities at commit time, reducing the cost and effort of remediation.

What is 'symbolic execution' in the context of security code analysis?

Answer: Analyzing a program by representing inputs as symbolic variables to explore all possible execution paths

Symbolic execution treats program inputs as symbolic values and explores multiple execution paths simultaneously to find inputs that trigger security-sensitive conditions.

An SDL team discovers a use-after-free bug during fuzzing. Which mitigation technique is most directly applicable at the compiler/runtime level?

Answer: Memory-safe language or AddressSanitizer

AddressSanitizer (ASan) detects use-after-free and other memory errors at runtime, and rewriting in a memory-safe language eliminates the class entirely.

In penetration testing scoping, what does 'rules of engagement' define?

Answer: Boundaries, permitted techniques, timing, and escalation procedures for the test

Rules of engagement formally define what systems may be targeted, which attack techniques are permitted, testing windows, and how critical findings should be escalated.

Which SDL documentation artifact records all identified vulnerabilities, their severity, remediation status, and owner?

Answer: Security bug tracking record / defect log

A security defect log (bug tracking record) captures each vulnerability's details, CVSS or bug-bar severity, assigned owner, and current remediation status throughout the SDL.