SDL Security Testing & Code Analysis 2 — Questions and Answers
Question 1: Which technique involves providing malformed or unexpected input to an application to discover security vulnerabilities?
- Penetration testing
- Fuzzing (Correct answer)
- Code review
- Threat modeling
Correct answer: Fuzzing
Fuzzing (fuzz testing) automatically supplies invalid, unexpected, or random data as input to a program to find crashes or security bugs.
Question 2: In SDL, what is the primary goal of attack surface analysis?
- Measure application performance under load
- Identify and reduce the number of exploitable entry points (Correct answer)
- Document all API endpoints for developers
- Automate regression testing
Correct answer: Identify and reduce the number of exploitable entry points
Attack surface analysis identifies all possible entry points an attacker could use, enabling teams to minimize and harden those areas.
Question 3: A security engineer finds that a web application concatenates user input directly into SQL queries. Which SAST finding category best describes this?
- Buffer overflow
- SQL injection sink (Correct answer)
- Cross-site request forgery
- Insecure deserialization
Correct answer: SQL injection sink
SAST tools classify direct concatenation of untrusted input into SQL statements as an SQL injection sink, indicating a data-flow vulnerability.
Question 4: Which SDL activity specifically validates that security controls implemented during development are functioning correctly in a running environment?
- Static analysis
- Dynamic analysis (DAST) (Correct answer)
- Design review
- Bug bar triage
Correct answer: Dynamic analysis (DAST)
Dynamic Application Security Testing (DAST) exercises a running application to verify that runtime security controls behave as expected.
Question 5: What does 'taint analysis' track in static code analysis tools?
- Memory allocation patterns
- Flow of untrusted data from sources to sensitive sinks (Correct answer)
- Code complexity metrics
- Authentication token lifetimes
Correct answer: Flow of untrusted data from sources to sensitive sinks
Taint analysis follows untrusted (tainted) data from user-controlled inputs through the code to security-sensitive operations (sinks) to detect injection flaws.
Question 6: During a code review, a reviewer notices a function that reads beyond the bounds of a fixed-size stack buffer. Which vulnerability class is this?
- Format string vulnerability
- Stack-based buffer overflow (Correct answer)
- Use-after-free
- Integer underflow
Correct answer: Stack-based buffer overflow
Reading or writing past the end of a fixed-size stack-allocated buffer is a classic stack-based buffer overflow vulnerability.
Question 7: Which SDL security testing phase is most appropriate for verifying that all items on the security 'bug bar' have been resolved before release?
- Threat modeling session
- Final security review (FSR) (Correct answer)
- Architecture risk analysis
- Requirements elicitation
Correct answer: Final security review (FSR)
The Final Security Review (FSR) is the SDL gate where teams confirm all bug bar issues are fixed or mitigated before shipping.
SDL Security Testing & Code Analysis 2
Which technique involves providing malformed or unexpected input to an application to discover security vulnerabilities?