SDL Compliance & Governance in SDLC 5

Question 1

A company's SDL requires a Coordinated Vulnerability Disclosure (CVD) policy. This policy primarily governs which aspect of the software lifecycle?

Accepted Answer

How external researchers can report vulnerabilities and how the company must respond

Answer

A CVD policy defines the process for external security researchers to responsibly report vulnerabilities and establishes the organization's response obligations and timelines.

Question 2

In the context of SDL compliance, 'security debt' refers to:

Accepted Answer

Accumulated unresolved security risks deferred from earlier SDL phases

Answer

Security debt is the accumulation of unresolved vulnerabilities and skipped security controls from earlier phases that must eventually be addressed.

Question 3

Which governance artifact maps each identified threat to a specific security control implemented to mitigate it?

Accepted Answer

Threat-to-control traceability matrix

Answer

A threat-to-control traceability matrix provides auditable evidence that every identified threat has a corresponding mitigating control, which is essential for compliance reporting.

Question 4

Under the Common Criteria (ISO/IEC 15408) framework, an Evaluation Assurance Level (EAL) primarily represents:

Accepted Answer

The rigor and depth of security evaluation applied to a product

Answer

EAL ratings (EAL1–EAL7) define the depth and stringency of the security evaluation process, not the product's features or the number of vulnerabilities found.

Question 5

An SDL program requires 'supply chain risk management' for all external dependencies. Which practice best operationalizes this requirement?

Accepted Answer

Continuously monitoring dependencies for known CVEs and requiring approval for new additions

Answer

Continuous CVE monitoring of dependencies and a formal approval process for new ones directly addresses supply chain security risk in the software development context.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Compliance & Governance in SDLC 5