SDL Compliance & Governance in SDLC 4

Question 1

In a heavily regulated industry, a new SDL policy requires every microservice to pass a security review before deployment. A team argues this slows releases unacceptably. The best governance response is to:

Accepted Answer

Define risk-tiered review tracks where lower-risk services use lighter-weight automated checks

Answer

Risk-tiered review tracks balance compliance rigor with delivery speed by applying appropriate scrutiny proportional to each service's risk profile.

Question 2

Which metric is most useful for demonstrating SDL compliance maturity to an executive steering committee?

Accepted Answer

Mean time to remediate critical security findings across the SDLC

Answer

Mean time to remediate critical findings directly measures how effectively the organization identifies and resolves security risk, which is the core outcome of SDL maturity.

Question 3

A compliance officer discovers that developers are skipping threat modeling to meet sprint deadlines. The most effective corrective governance action is to:

Accepted Answer

Make threat modeling a mandatory gate with sign-off before Design phase exit

Answer

Making threat modeling a hard gate with required sign-off enforces compliance at the process level rather than relying on developer discretion under schedule pressure.

Question 4

Under GDPR's 'Privacy by Design' principle, privacy controls should be integrated into software at which SDL stage?

Accepted Answer

Requirements and Design

Answer

Privacy by Design mandates that privacy controls be proactively built in during Requirements and Design, not added reactively after the system is built.

Question 5

An SDL governance program introduces 'Security Champions' in each development team. Their primary role is to:

Accepted Answer

Act as the security team's liaison within the dev team and promote security practices day-to-day

Answer

Security Champions embed security culture within teams by bridging the gap between central security teams and developers, not by replacing either function.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Compliance & Governance in SDLC 4