SDL Secure Software Development Practices 2

Question 1

Which SDL activity is specifically designed to identify security vulnerabilities by having experts manually examine code without executing it?

Accepted Answer

Static code analysis

Answer

Static code analysis examines source code without executing it to find vulnerabilities like buffer overflows, injection flaws, and insecure API usage.

Question 2

In SDL, what is the primary purpose of an 'abuse case' during requirements gathering?

Accepted Answer

To describe how an attacker might misuse the system

Answer

Abuse cases describe malicious or unintended uses of a system, helping teams design defenses against specific attack patterns during early requirements phases.

Question 3

Which cryptographic practice is mandated by SDL to ensure sensitive data remains protected if a single algorithm is broken?

Accepted Answer

Implementing cryptographic agility

Answer

Cryptographic agility allows systems to swap out algorithms without major redesign, ensuring resilience when cryptographic weaknesses are discovered.

Question 4

During SDL's Verification phase, what does 'attack surface review' primarily assess?

Accepted Answer

All user-accessible entry points that attackers could exploit

Answer

Attack surface review inventories all exposed interfaces, APIs, data inputs, and protocols to ensure unnecessary entry points are eliminated before release.

Question 5

What SDL principle requires that components operate with only the permissions necessary to perform their intended function?

Accepted Answer

Least privilege

Answer

Least privilege limits the access rights of processes and users to the minimum needed, reducing the blast radius if a component is compromised.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Secure Software Development Practices 2