SE Secure Software Development and Application Security 3

Question 1

Which threat modeling methodology developed by Microsoft uses the acronym STRIDE to categorize software threats?

Accepted Answer

Microsoft's STRIDE model

Answer

PASTA (Process for Attack Simulation and Threat Analysis)

Answer

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)

Answer

VAST (Visual, Agile, and Simple Threat modeling)

Question 2

What is the primary goal of integrating security into the DevOps pipeline (DevSecOps)?

Accepted Answer

Shifting security left to identify and remediate vulnerabilities earlier in the SDLC

Answer

Slowing deployment velocity to allow thorough manual security reviews

Answer

Replacing traditional penetration testing entirely with automated scanning tools

Answer

Delegating all security responsibilities to the security operations team

Question 3

What is the purpose of a Software Bill of Materials (SBOM)?

Accepted Answer

To provide a complete inventory of components, libraries, and dependencies in a software product

Answer

To document the cost breakdown of all software development activities

Answer

To list all known software defects and their remediation status

Answer

To track open-source license compliance obligations exclusively

Question 4

During a secure code review of a web application, which area is MOST critical to examine for high-severity vulnerabilities?

Accepted Answer

Input handling, output encoding, and authentication and authorization logic

Answer

Code formatting consistency and adherence to style guides

Answer

Database query optimization and connection pooling configuration

Answer

UI/UX design patterns and accessibility compliance

Question 5

What does software supply chain security primarily address?

Accepted Answer

Protecting the integrity of code, dependencies, and build processes from development through deployment

Answer

Ensuring fast and reliable delivery of software updates to end users

Answer

Managing software procurement costs and vendor contracts

Answer

Optimizing CI/CD pipeline throughput and deployment frequency

Question 6

During which Secure SDLC phase are Data Flow Diagrams (DFDs) and trust boundaries typically created?

Accepted Answer

Threat modeling during the design phase

Answer

Requirements gathering and stakeholder interviews

Answer

Security regression testing during QA

Answer

Post-deployment security monitoring

Question 7

What is the key difference between SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing)?

Accepted Answer

SAST analyzes code without execution while DAST tests the running application from the outside

Answer

SAST tests production systems while DAST tests development environments

Answer

SAST is performed only by developers while DAST requires certified external testers

Answer

SAST detects only injection vulnerabilities while DAST finds only configuration issues