SDL Security Testing & Code Analysis 4 — Questions and Answers
Question 1: Which metric produced by static analysis tools indicates the proportion of code paths exercised during testing?
- Cyclomatic complexity
- Code coverage (Correct answer)
- Halstead volume
- Lines of code
Correct answer: Code coverage
Code coverage measures the percentage of statements, branches, or paths executed by a test suite, helping identify untested and potentially vulnerable code.
Question 2: In SDL, 'red team' exercises are primarily intended to:
- Train developers on secure coding techniques
- Simulate real adversary tactics to find exploitable weaknesses before attackers do (Correct answer)
- Automate compliance reporting
- Review design documents for architectural flaws
Correct answer: Simulate real adversary tactics to find exploitable weaknesses before attackers do
Red team exercises employ adversarial thinking and techniques to identify vulnerabilities and attack chains that traditional testing may miss.
Question 3: Which of the following is a key advantage of integrating SAST tools into a CI/CD pipeline?
- Eliminates the need for dynamic testing
- Provides immediate feedback to developers on security issues as code is committed (Correct answer)
- Replaces manual code review entirely
- Guarantees zero false positives
Correct answer: Provides immediate feedback to developers on security issues as code is committed
Integrating SAST into CI/CD enables shift-left security by alerting developers to potential vulnerabilities at commit time, reducing the cost and effort of remediation.
Question 4: What is 'symbolic execution' in the context of security code analysis?
- Running a program with real inputs to observe behavior
- Analyzing a program by representing inputs as symbolic variables to explore all possible execution paths (Correct answer)
- Obfuscating source code to protect intellectual property
- Generating call graphs for dependency mapping
Correct answer: Analyzing a program by representing inputs as symbolic variables to explore all possible execution paths
Symbolic execution treats program inputs as symbolic values and explores multiple execution paths simultaneously to find inputs that trigger security-sensitive conditions.
Question 5: An SDL team discovers a use-after-free bug during fuzzing. Which mitigation technique is most directly applicable at the compiler/runtime level?
- Address Space Layout Randomization (ASLR)
- Memory-safe language or AddressSanitizer (Correct answer)
- Data Execution Prevention (DEP)
- Stack canaries
Correct answer: Memory-safe language or AddressSanitizer
AddressSanitizer (ASan) detects use-after-free and other memory errors at runtime, and rewriting in a memory-safe language eliminates the class entirely.
Question 6: In penetration testing scoping, what does 'rules of engagement' define?
- The programming languages the tester may use
- Boundaries, permitted techniques, timing, and escalation procedures for the test (Correct answer)
- The CVE database version the tester must reference
- Which team members must attend the kickoff meeting
Correct answer: Boundaries, permitted techniques, timing, and escalation procedures for the test
Rules of engagement formally define what systems may be targeted, which attack techniques are permitted, testing windows, and how critical findings should be escalated.
Question 7: Which SDL documentation artifact records all identified vulnerabilities, their severity, remediation status, and owner?
- Threat model diagram
- Security bug tracking record / defect log (Correct answer)
- Design specification
- Test plan
Correct answer: Security bug tracking record / defect log
A security defect log (bug tracking record) captures each vulnerability's details, CVSS or bug-bar severity, assigned owner, and current remediation status throughout the SDL.
SDL Security Testing & Code Analysis 4
Which metric produced by static analysis tools indicates the proportion of code paths exercised during testing?