SDL Security Testing & Code Analysis 5

Question 1

Which approach to security testing analyzes binaries or compiled code without access to source code?

Accepted Answer

Binary / black-box static analysis (BAST)

Answer

Binary static analysis examines compiled executables to find vulnerabilities when source code is unavailable, commonly used for third-party components.

Question 2

A developer introduces a check that validates input length only on the client side (browser). Why is this insufficient from an SDL perspective?

Accepted Answer

Attackers can bypass client-side validation by intercepting and modifying requests before they reach the server

Answer

Client-side controls can be bypassed with proxies or direct HTTP requests; SDL requires server-side validation as the authoritative enforcement point.

Question 3

Which OWASP testing technique involves manually walking through an application's authentication flow to identify logic flaws?

Accepted Answer

Manual testing / business logic testing

Answer

Business logic testing requires human testers to reason about intended workflows and test for flaws that automated tools cannot detect because they require contextual understanding.

Question 4

What is 'differential fuzzing'?

Accepted Answer

Comparing outputs of two implementations with the same inputs to detect behavioral discrepancies

Answer

Differential fuzzing feeds identical inputs to multiple implementations and flags cases where outputs differ, revealing inconsistencies that may indicate security bugs.

Question 5

In SDL, which process ensures that security requirements derived from threat modeling are verifiable through testing?

Accepted Answer

Security test case derivation from threats

Answer

Deriving security test cases directly from threat model mitigations ensures every identified threat has a corresponding test that validates the control is effective.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Security Testing & Code Analysis 5