SDL Compliance & Governance in SDLC 2 — Questions and Answers
Question 1: Under HIPAA, which SDL phase is most critical for ensuring Protected Health Information (PHI) is handled securely in software?
- Requirements (Correct answer)
- Deployment
- Maintenance
- Testing
Correct answer: Requirements
The Requirements phase is most critical because HIPAA compliance obligations — such as access controls and audit logging for PHI — must be identified and embedded before design begins.
Question 2: A governance board requires all third-party libraries to be approved before use. Which SDL artifact formally tracks this approval?
- Software Bill of Materials (SBOM) (Correct answer)
- Threat model document
- Penetration test report
- Security test plan
Correct answer: Software Bill of Materials (SBOM)
An SBOM inventories all third-party components and their approval status, making it the primary artifact for governing open-source and third-party library usage.
Question 3: PCI DSS Requirement 6 mandates secure software development. Which SDL practice most directly satisfies this requirement?
- Formal code review with security criteria (Correct answer)
- Daily standups
- Automated UI testing
- Continuous integration pipelines
Correct answer: Formal code review with security criteria
PCI DSS Requirement 6 specifically calls for secure coding guidelines and code reviews that check for security vulnerabilities.
Question 4: Which regulatory framework specifically requires organizations to conduct a Data Protection Impact Assessment (DPIA) before processing high-risk personal data?
- GDPR (Correct answer)
- SOX
- FISMA
- HIPAA
Correct answer: GDPR
GDPR Article 35 mandates DPIAs for processing activities that are likely to result in a high risk to individuals' rights and freedoms.
Question 5: An organization subject to FISMA must ensure its software development aligns with which publication for security controls?
- NIST SP 800-53 (Correct answer)
- ISO 27001
- OWASP ASVS
- CIS Benchmarks
Correct answer: NIST SP 800-53
FISMA requires federal agencies and their contractors to implement security controls defined in NIST SP 800-53.
Question 6: In SDL governance, what is the purpose of a Security Gate Review before the Design phase begins?
- To verify security requirements are complete before architecture decisions are made (Correct answer)
- To sign off on the final code before release
- To approve the penetration test scope
- To authorize the vulnerability scan schedule
Correct answer: To verify security requirements are complete before architecture decisions are made
A pre-Design Security Gate ensures security requirements are fully defined so architects can build them into the system design rather than retrofitting later.
Question 7: SOX compliance in software development primarily concerns which aspect of the SDL?
- Change control and audit trails for financial application code (Correct answer)
- Encryption strength of stored passwords
- Penetration testing frequency
- Open-source license compliance
Correct answer: Change control and audit trails for financial application code
SOX Section 404 requires verifiable change management controls and audit trails for systems affecting financial reporting.
SDL Compliance & Governance in SDLC 2
Under HIPAA, which SDL phase is most critical for ensuring Protected Health Information (PHI) is handled securely in software?