SDL Compliance & Governance in SDLC 3 — Questions and Answers
Question 1: Which role is typically accountable for approving the final Security Exception before a product ships despite an unresolved critical vulnerability?
- Chief Information Security Officer (CISO) (Correct answer)
- Development team lead
- QA manager
- Scrum master
Correct answer: Chief Information Security Officer (CISO)
The CISO or equivalent executive is accountable for accepting residual risk when a security exception is granted, as this is an organizational risk decision.
Question 2: A company must demonstrate SDL compliance to auditors. Which document best proves that security activities were performed during development?
- SDL completion checklist with dated sign-offs (Correct answer)
- Sprint velocity report
- Product backlog
- UI design mockups
Correct answer: SDL completion checklist with dated sign-offs
A dated SDL completion checklist with sign-offs provides auditors with traceable evidence that each required security activity was performed at the appropriate phase.
Question 3: ISO/IEC 27034 provides a framework for what aspect of software security governance?
- Application security controls and their integration into the software lifecycle (Correct answer)
- Cloud infrastructure security
- Incident response procedures
- Employee background checks
Correct answer: Application security controls and their integration into the software lifecycle
ISO/IEC 27034 specifically defines how organizations should structure application security controls and integrate them throughout the application lifecycle.
Question 4: A regulated financial firm requires all SDL security decisions to be traceable to business risk. This is best achieved through which governance mechanism?
- Risk register linked to SDL phase deliverables (Correct answer)
- Weekly status emails to stakeholders
- Automated SAST tool integration
- Developer security training certificates
Correct answer: Risk register linked to SDL phase deliverables
A risk register that maps identified security risks to SDL deliverables creates a traceable chain from business impact to development decisions.
Question 5: Under the Microsoft SDL, what is the purpose of the 'Final Security Review' (FSR)?
- To evaluate all security activities completed and determine release readiness (Correct answer)
- To perform a final usability test
- To review marketing materials for accuracy
- To confirm that all features are implemented
Correct answer: To evaluate all security activities completed and determine release readiness
The FSR in Microsoft's SDL evaluates whether all required security activities have been completed and whether the product meets the security bar for release.
Question 6: Which compliance standard explicitly requires a Secure Software Development Framework (SSDF) alignment for US federal software suppliers?
- NIST SP 800-218 (SSDF) (Correct answer)
- PCI DSS v4.0
- GDPR Article 25
- ISO 27001:2022
Correct answer: NIST SP 800-218 (SSDF)
NIST SP 800-218 defines the Secure Software Development Framework (SSDF) and its adoption is required for US federal software suppliers per Executive Order 14028.
Question 7: When a vulnerability is discovered post-release and a patch is issued, which SDL governance process ensures future versions don't reintroduce the same flaw?
- Root cause analysis feeding back into security requirements and coding standards (Correct answer)
- Hotfix deployment pipeline
- Bug bounty program expansion
- Increased test coverage metrics
Correct answer: Root cause analysis feeding back into security requirements and coding standards
Root cause analysis that feeds findings back into requirements and standards is the SDL mechanism that prevents vulnerability recurrence across future product versions.
SDL Compliance & Governance in SDLC 3
Which role is typically accountable for approving the final Security Exception before a product ships despite an unresolved critical vulnerability?