SDL Compliance & Governance in SDLC 5 — Questions and Answers
Question 1: A company's SDL requires a Coordinated Vulnerability Disclosure (CVD) policy. This policy primarily governs which aspect of the software lifecycle?
- How external researchers can report vulnerabilities and how the company must respond (Correct answer)
- How developers submit code for internal review
- How vulnerabilities are prioritized in the sprint backlog
- How third-party auditors conduct assessments
Correct answer: How external researchers can report vulnerabilities and how the company must respond
A CVD policy defines the process for external security researchers to responsibly report vulnerabilities and establishes the organization's response obligations and timelines.
Question 2: In the context of SDL compliance, 'security debt' refers to:
- Accumulated unresolved security risks deferred from earlier SDL phases (Correct answer)
- The cost of security tools and licenses
- Technical debt unrelated to security
- Budget allocated for future penetration tests
Correct answer: Accumulated unresolved security risks deferred from earlier SDL phases
Security debt is the accumulation of unresolved vulnerabilities and skipped security controls from earlier phases that must eventually be addressed.
Question 3: Which governance artifact maps each identified threat to a specific security control implemented to mitigate it?
- Threat-to-control traceability matrix (Correct answer)
- Change request log
- Sprint burndown chart
- Deployment checklist
Correct answer: Threat-to-control traceability matrix
A threat-to-control traceability matrix provides auditable evidence that every identified threat has a corresponding mitigating control, which is essential for compliance reporting.
Question 4: Under the Common Criteria (ISO/IEC 15408) framework, an Evaluation Assurance Level (EAL) primarily represents:
- The rigor and depth of security evaluation applied to a product (Correct answer)
- The number of vulnerabilities found during testing
- The market price of a security product
- The compliance level with GDPR requirements
Correct answer: The rigor and depth of security evaluation applied to a product
EAL ratings (EAL1–EAL7) define the depth and stringency of the security evaluation process, not the product's features or the number of vulnerabilities found.
Question 5: An SDL program requires 'supply chain risk management' for all external dependencies. Which practice best operationalizes this requirement?
- Continuously monitoring dependencies for known CVEs and requiring approval for new additions (Correct answer)
- Reviewing supplier financial stability annually
- Using only open-source libraries
- Requiring all dependencies to be US-based vendors
Correct answer: Continuously monitoring dependencies for known CVEs and requiring approval for new additions
Continuous CVE monitoring of dependencies and a formal approval process for new ones directly addresses supply chain security risk in the software development context.
Question 6: A development team uses an Agile methodology. How should SDL security gates be adapted for Agile to maintain governance without blocking delivery?
- Integrate security activities as Definition of Done criteria within each sprint (Correct answer)
- Perform all security reviews in a waterfall phase at the end of each quarter
- Skip security gates for Agile teams and rely solely on automated scanning
- Conduct security reviews only for major releases, not sprints
Correct answer: Integrate security activities as Definition of Done criteria within each sprint
Embedding security activities into the Definition of Done ensures security governance is continuous and sprint-native rather than a blocking end-phase activity.
Question 7: Which compliance requirement mandates that organizations maintain a vulnerability management program with defined SLAs for patching critical vulnerabilities in software?
- PCI DSS Requirement 6.3 (Correct answer)
- HIPAA Privacy Rule
- SOX Section 302
- GDPR Article 17
Correct answer: PCI DSS Requirement 6.3
PCI DSS Requirement 6.3 specifically mandates a vulnerability management process that includes defined timeframes for patching critical vulnerabilities in bespoke and custom software.
SDL Compliance & Governance in SDLC 5
A company's SDL requires a Coordinated Vulnerability Disclosure (CVD) policy.
This policy primarily governs which aspect of the software lifecycle?