SDL Compliance & Governance in SDLC 2

Question 1

Under HIPAA, which SDL phase is most critical for ensuring Protected Health Information (PHI) is handled securely in software?

Accepted Answer

Requirements

Answer

The Requirements phase is most critical because HIPAA compliance obligations — such as access controls and audit logging for PHI — must be identified and embedded before design begins.

Question 2

A governance board requires all third-party libraries to be approved before use. Which SDL artifact formally tracks this approval?

Accepted Answer

Software Bill of Materials (SBOM)

Answer

An SBOM inventories all third-party components and their approval status, making it the primary artifact for governing open-source and third-party library usage.

Question 3

PCI DSS Requirement 6 mandates secure software development. Which SDL practice most directly satisfies this requirement?

Accepted Answer

Formal code review with security criteria

Answer

PCI DSS Requirement 6 specifically calls for secure coding guidelines and code reviews that check for security vulnerabilities.

Question 4

Which regulatory framework specifically requires organizations to conduct a Data Protection Impact Assessment (DPIA) before processing high-risk personal data?

Accepted Answer

GDPR

Answer

GDPR Article 35 mandates DPIAs for processing activities that are likely to result in a high risk to individuals' rights and freedoms.

Question 5

An organization subject to FISMA must ensure its software development aligns with which publication for security controls?

Accepted Answer

NIST SP 800-53

Answer

FISMA requires federal agencies and their contractors to implement security controls defined in NIST SP 800-53.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Compliance & Governance in SDLC 2