SDL Secure Software Development Practices 4

Question 1

In Microsoft SDL, what is the 'bug bar' used for?

Accepted Answer

Defining severity thresholds that determine which security bugs must be fixed before release

Answer

The bug bar establishes minimum severity levels (e.g., Critical, Important) that must be resolved before a product can ship, ensuring high-risk vulnerabilities are not deferred.

Question 2

Which SDL phase is responsible for creating data flow diagrams (DFDs) to visualize how data moves through a system?

Accepted Answer

Design (threat modeling)

Answer

Threat modeling during the Design phase uses DFDs to map trust boundaries, data flows, and entry points, enabling systematic threat identification.

Question 3

What is 'defense in depth' in the context of SDL?

Accepted Answer

Layering multiple independent security controls so bypassing one does not compromise the system

Answer

Defense in depth applies multiple, overlapping security layers so that a failure in any single control does not result in a complete system compromise.

Question 4

When SDL requires 'secure defaults,' what does this mean in practice?

Accepted Answer

The most secure settings are enabled out-of-the-box and users must explicitly reduce security

Answer

Secure defaults mean the system ships in its most protected configuration, reducing risk for users who do not customize settings.

Question 5

In SDL, which activity specifically validates that security requirements have been implemented correctly by inspecting the final build?

Accepted Answer

Final Security Review (FSR)

Answer

The FSR is a formal gate where a security team confirms all SDL requirements are met, outstanding risks are accepted, and the product is cleared for release.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Secure Software Development Practices 4