SDL Compliance & Governance in SDLC 3

Question 1

Which role is typically accountable for approving the final Security Exception before a product ships despite an unresolved critical vulnerability?

Accepted Answer

Chief Information Security Officer (CISO)

Answer

The CISO or equivalent executive is accountable for accepting residual risk when a security exception is granted, as this is an organizational risk decision.

Question 2

A company must demonstrate SDL compliance to auditors. Which document best proves that security activities were performed during development?

Accepted Answer

SDL completion checklist with dated sign-offs

Answer

A dated SDL completion checklist with sign-offs provides auditors with traceable evidence that each required security activity was performed at the appropriate phase.

Question 3

ISO/IEC 27034 provides a framework for what aspect of software security governance?

Accepted Answer

Application security controls and their integration into the software lifecycle

Answer

ISO/IEC 27034 specifically defines how organizations should structure application security controls and integrate them throughout the application lifecycle.

Question 4

A regulated financial firm requires all SDL security decisions to be traceable to business risk. This is best achieved through which governance mechanism?

Accepted Answer

Risk register linked to SDL phase deliverables

Answer

A risk register that maps identified security risks to SDL deliverables creates a traceable chain from business impact to development decisions.

Question 5

Under the Microsoft SDL, what is the purpose of the 'Final Security Review' (FSR)?

Accepted Answer

To evaluate all security activities completed and determine release readiness

Answer

The FSR in Microsoft's SDL evaluates whether all required security activities have been completed and whether the product meets the security bar for release.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Compliance & Governance in SDLC 3