SDL Security Testing & Code Analysis 5 — Questions and Answers
Question 1: Which approach to security testing analyzes binaries or compiled code without access to source code?
- White-box static analysis
- Binary / black-box static analysis (BAST) (Correct answer)
- Dynamic taint tracking
- Model-based testing
Correct answer: Binary / black-box static analysis (BAST)
Binary static analysis examines compiled executables to find vulnerabilities when source code is unavailable, commonly used for third-party components.
Question 2: A developer introduces a check that validates input length only on the client side (browser). Why is this insufficient from an SDL perspective?
- Client-side checks are slower than server-side checks
- Attackers can bypass client-side validation by intercepting and modifying requests before they reach the server (Correct answer)
- Client-side code uses different programming languages
- Length validation is not a recognized security control
Correct answer: Attackers can bypass client-side validation by intercepting and modifying requests before they reach the server
Client-side controls can be bypassed with proxies or direct HTTP requests; SDL requires server-side validation as the authoritative enforcement point.
Question 3: Which OWASP testing technique involves manually walking through an application's authentication flow to identify logic flaws?
- Automated scanning
- Manual testing / business logic testing (Correct answer)
- Fuzzing
- Dependency scanning
Correct answer: Manual testing / business logic testing
Business logic testing requires human testers to reason about intended workflows and test for flaws that automated tools cannot detect because they require contextual understanding.
Question 4: What is 'differential fuzzing'?
- Fuzzing two different builds of the same software simultaneously to find crashes
- Comparing outputs of two implementations with the same inputs to detect behavioral discrepancies (Correct answer)
- Applying different mutation strategies in parallel
- Fuzzing network protocols versus file parsers concurrently
Correct answer: Comparing outputs of two implementations with the same inputs to detect behavioral discrepancies
Differential fuzzing feeds identical inputs to multiple implementations and flags cases where outputs differ, revealing inconsistencies that may indicate security bugs.
Question 5: In SDL, which process ensures that security requirements derived from threat modeling are verifiable through testing?
- Risk acceptance
- Security test case derivation from threats (Correct answer)
- Compliance audit
- Security awareness training
Correct answer: Security test case derivation from threats
Deriving security test cases directly from threat model mitigations ensures every identified threat has a corresponding test that validates the control is effective.
Question 6: Which code analysis technique builds a graph of all possible execution flows through a program to identify unreachable code or dangerous paths?
- Lexical analysis
- Control flow graph (CFG) analysis (Correct answer)
- Abstract syntax tree (AST) diffing
- Dependency inversion analysis
Correct answer: Control flow graph (CFG) analysis
Control flow graph analysis constructs a directed graph of all execution paths, enabling tools to detect dead code, missing error handling, and security-sensitive execution paths.
Question 7: When reviewing cryptographic code, which practice violates SDL secure coding standards?
- Using a well-tested cryptographic library
- Implementing a custom encryption algorithm instead of a vetted standard (Correct answer)
- Storing keys in a hardware security module
- Using authenticated encryption modes like AES-GCM
Correct answer: Implementing a custom encryption algorithm instead of a vetted standard
SDL prohibits 'rolling your own crypto' because custom algorithms almost always contain subtle flaws; only peer-reviewed, industry-standard algorithms should be used.
SDL Security Testing & Code Analysis 5
Which approach to security testing analyzes binaries or compiled code without access to source code?