Security Testing & Code Analysis Flashcards

Which type of fuzzer generates test cases by mutating known valid inputs rather than building inputs from a grammar?

Answer: Mutation-based fuzzer

Mutation-based fuzzers take valid seed inputs and apply random or heuristic mutations to create test cases, making them easy to set up for unknown formats.

In the context of SDL code review, what is a 'false positive'?

Answer: A reported issue that is not actually a vulnerability

A false positive is a finding flagged by an analysis tool that, upon investigation, does not represent a real security vulnerability.

Which tool category is best suited for finding security vulnerabilities in third-party libraries included in a project?

Answer: Software Composition Analysis (SCA)

Software Composition Analysis (SCA) tools inventory open-source and third-party dependencies and check them against known vulnerability databases like the NVD.

What is the purpose of a 'security unit test' in SDL?

Answer: Verify that a specific security control or mitigation behaves correctly in isolation

Security unit tests verify that individual security controls—such as input validation or output encoding—function correctly, enabling early detection of regressions.

A developer uses 'printf(userInput)' without a format string argument in C. Which vulnerability does this introduce?

Answer: Format string vulnerability

Passing user-controlled input directly as the format string argument to printf allows attackers to read or write memory using format specifiers like %x or %n.

Which SDL concept defines the minimum threshold of security quality that a product must meet before it can ship?

Answer: Bug bar

The SDL bug bar establishes minimum acceptable severity thresholds; any vulnerability at or above the bar must be fixed or have an approved exception before release.

Penetration testing performed without any prior knowledge of the target system is called what?

Answer: Black-box testing

Black-box penetration testing simulates an external attacker with no insider knowledge of the system's architecture, source code, or credentials.