SDL Secure Software Development Practices 3

Question 1

What is the SDL concept of 'security response' primarily concerned with?

Accepted Answer

Having a defined process to address newly discovered vulnerabilities post-release

Answer

SDL's security response plan defines how organizations triage, patch, and communicate vulnerabilities discovered in released software to minimize customer impact.

Question 2

Which SDL design principle recommends breaking a system into isolated components so a breach in one does not compromise others?

Accepted Answer

Compartmentalization

Answer

Compartmentalization (also called isolation or sandboxing) contains breaches by ensuring components cannot freely access each other's data or functions.

Question 3

In SDL, what must be completed before a product can pass the Final Security Review (FSR)?

Accepted Answer

All mandatory SDL tasks and any outstanding security bugs mitigated

Answer

The FSR verifies that all required SDL activities have been performed and that high-severity security issues have been addressed or formally accepted.

Question 4

Which type of SDL security test sends real exploit payloads against a running application to validate vulnerabilities found in static analysis?

Accepted Answer

Dynamic application security testing (DAST)

Answer

DAST tests a running application by sending malicious payloads, confirming that vulnerabilities detected statically are actually exploitable at runtime.

Question 5

What SDL guideline applies when third-party or open-source components are incorporated into a product?

Accepted Answer

They must be inventoried, monitored for vulnerabilities, and updated when patches are released

Answer

SDL requires tracking all third-party dependencies because vulnerabilities in them become vulnerabilities in your product, regardless of their origin.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Secure Software Development Practices 3