SDL Security Testing & Code Analysis 3 — Questions and Answers
Question 1: Which type of fuzzer generates test cases by mutating known valid inputs rather than building inputs from a grammar?
- Generation-based fuzzer
- Mutation-based fuzzer (Correct answer)
- Symbolic execution engine
- Differential fuzzer
Correct answer: Mutation-based fuzzer
Mutation-based fuzzers take valid seed inputs and apply random or heuristic mutations to create test cases, making them easy to set up for unknown formats.
Question 2: In the context of SDL code review, what is a 'false positive'?
- A real vulnerability that was not reported by the tool
- A reported issue that is not actually a vulnerability (Correct answer)
- A vulnerability exploited in production
- A security control that passes all tests
Correct answer: A reported issue that is not actually a vulnerability
A false positive is a finding flagged by an analysis tool that, upon investigation, does not represent a real security vulnerability.
Question 3: Which tool category is best suited for finding security vulnerabilities in third-party libraries included in a project?
- DAST scanner
- Software Composition Analysis (SCA) (Correct answer)
- Network vulnerability scanner
- Fuzz harness
Correct answer: Software Composition Analysis (SCA)
Software Composition Analysis (SCA) tools inventory open-source and third-party dependencies and check them against known vulnerability databases like the NVD.
Question 4: What is the purpose of a 'security unit test' in SDL?
- Replace manual penetration testing
- Verify that a specific security control or mitigation behaves correctly in isolation (Correct answer)
- Generate threat models automatically
- Measure code coverage for compliance reporting
Correct answer: Verify that a specific security control or mitigation behaves correctly in isolation
Security unit tests verify that individual security controls—such as input validation or output encoding—function correctly, enabling early detection of regressions.
Question 5: A developer uses 'printf(userInput)' without a format string argument in C. Which vulnerability does this introduce?
- Buffer overflow
- Format string vulnerability (Correct answer)
- Integer overflow
- Race condition
Correct answer: Format string vulnerability
Passing user-controlled input directly as the format string argument to printf allows attackers to read or write memory using format specifiers like %x or %n.
Question 6: Which SDL concept defines the minimum threshold of security quality that a product must meet before it can ship?
- Attack surface metric
- Bug bar (Correct answer)
- Security risk score
- Compliance checklist
Correct answer: Bug bar
The SDL bug bar establishes minimum acceptable severity thresholds; any vulnerability at or above the bar must be fixed or have an approved exception before release.
Question 7: Penetration testing performed without any prior knowledge of the target system is called what?
- White-box testing
- Gray-box testing
- Black-box testing (Correct answer)
- Crystal-box testing
Correct answer: Black-box testing
Black-box penetration testing simulates an external attacker with no insider knowledge of the system's architecture, source code, or credentials.
SDL Security Testing & Code Analysis 3
Which type of fuzzer generates test cases by mutating known valid inputs rather than building inputs from a grammar?