Enhance Your Career With Available Preparation Guide for Secure-Software-Design Exam
Get Special Discount Offer of Secure-Software-Design Certification Exam Sample Questions and Answers
NEW QUESTION # 31
What is the last slop of the SDLOSDL code review process?
- A. Perform preliminary scan
- B. Review code for security issues
- C. Review for security issues unique to the architecture
- D. Identify security code review objectives
Answer: B
Explanation:
The last step of the SDLC code review process is to review the code for security issues. This involves a detailed examination of the code to identify any potential security vulnerabilities that could be exploited. It's a critical phase where the focus is on ensuring that the code adheres to security best practices and does not contain any flaws that could compromise the security of the application or system. The process typically includes manual inspection as well as automated tools to scan for common security issues. The goal is to ensure that the software is as secure as possible before it is deployed. References: Mastering the Code Review Process, Understanding the SDLC, How Code Reviews Improve Software Quality in SDLC - LinkedIn.
NEW QUESTION # 32
Which DKEAD category has a risk rating based on the threat exploit's potential level of harm?
- A. Reproducibility
- B. Exploitability
- C. Damage potential
- D. Affected users
Answer: C
Explanation:
The DKEAD category that has a risk rating based on the threat exploit's potential level of harm is Damage potential. This category assesses the total damage or impact that a threat could cause if it is exploited by an attacker. The risk rating in this category is determined by evaluating the severity of the potential damage, which could range from information disclosure to complete system destruction or loss of system availability.
References:
* DREAD Threat Modeling1
* OWASP Risk Rating Methodology2
* DREAD Threat Modeling: An Introduction to Qualitative Risk Analysis3
NEW QUESTION # 33
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?
- A. Data protection
- B. Authentication
- C. Input validation
- D. Access control
Answer: D
Explanation:
The secure coding practice being described is Access Control. This practice ensures that access to data and features within a system is restricted and controlled. The description given indicates that the product has mechanisms to prevent the display of personally identifiable information (PII), restrict the printing of private documents, and require elevated privileges to access archived documents. These are all measures to control who has access to what data and under what circumstances, which is the essence of access control.
References:
* ISO/IEC 27018 Code of Practice for Protecting Personal Data in the Cloud1.
* NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)2.
* ISO/IEC 29151:2017, Code of practice for personally identifiable information protection3.
NEW QUESTION # 34
The security team has received notice of an insecure direct object reference vulnerability in a third-party component library that could result in remote code execution. The component library was replaced and is no longer being used within the application.
How should the organization remediate this vulnerability?
- A. Access to Configuration Files Is Limited to Administrators
- B. Ensure Auditing and Logging Is Enabled on All Servers
- C. Enforce the Removal of Unused Dependencies
- D. Ensure Sensitive Information Is Not Logged
Answer: C
NEW QUESTION # 35
The Chief Information Security Officer (CISO) has recommended contracting with external experts to perform annual reviews of the enterprise's software products, including penetration testing.
Which post-release deliverable is being described?
- A. Third-Party Security Review
- B. Security Strategy for Legacy Code
- C. Post-Release Certifications
- D. External Vulnerability Disclosure Response Process
Answer: A
NEW QUESTION # 36
Which type of security analysis is performed by reviewing source code line-by-line after other security analysis techniques have been executed?
- A. Fuzz Testing
- B. Static Analysis
- C. Dynamic Analysis
- D. Manual Code Review
Answer: D
NEW QUESTION # 37
The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.
Which security testing technique is being used?
- A. Binary fault injection
- B. Binary code analysis
- C. Fuzz testing
- D. Dynamic code analysis
Answer: C
Explanation:
Fuzz testing is the ideal technique in this scenario. Here's why:
* Focus on Integrations: The scenario emphasizes testing links between the software, databases, web servers, and web services. Fuzz testing is specifically designed to find vulnerabilities in how software handles data and communication between components.
* Pre-release Testing: The product being close to release indicates a critical need to identify security flaws before public deployment. Fuzz testing is effective in uncovering unexpected behavior and potential vulnerabilities.
* Fuzz Testing Targets: Fuzz testing works by injecting invalid or unexpected data into interfaces (like those between databases, web components, etc.) to observe how the software reacts. This helps expose potential security gaps and weaknesses.
NEW QUESTION # 38
Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?
- A. Session Management
- B. Input Validation
- C. Memory Management
- D. Data Protection
Answer: C
NEW QUESTION # 39
Which privacy impact statement requirement type defines processes to keep personal information updated and accurate?
- A. Data integrity requirements
- B. Collection of personal information requirements
- C. Personal information retention requirements
- D. Access requirements
Answer: A
Explanation:
Data integrity requirements within a privacy impact statement ensure that personal information is maintained in an accurate and up-to-date manner. This involves establishing processes to regularly review and update personal data, as well as correct any inaccuracies. These requirements are crucial for maintaining the trustworthiness of the data and ensuring that decisions made based on this information are sound and reliable.
:
The Office of the Privacy Commissioner of Canada's guide on the Privacy Impact Assessment process emphasizes the importance of accuracy and currency of personal information1.
The European Union's General Data Protection Regulation (GDPR) outlines principles for data processing, including the necessity for data to be accurate and kept up to date2.
The General Data Protection Regulation (GDPR) also includes provisions for data protection impact assessments, which involve documenting processes before starting data processing3.
NEW QUESTION # 40
While performing functional testing of the new product from a shared machine, a QA analyst closed their browser window but did not logout of the application. A different QA analyst accessed the application an hour later and was not prompted to login. They then noticed the previous analyst was still logged into the application.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure no sensitive information is stored in plain text in cookies
- B. Ensure user sessions timeout after short intervals
- C. Ensure role-based access control is enforced for access to all resources
- D. Ensure strong password policies are enforced
Answer: B
Explanation:
The issue described involves a session management vulnerability where the user's session remains active even after the browser window is closed, allowing another user on the same machine to access the application without logging in. To prevent this security risk, it's essential to adjust the session management controls to include an automatic timeout feature. This means that after a period of inactivity, or when the browser window is closed, the session should automatically expire, requiring a new login to access the application.
This adjustment ensures that even if a user forgets to log out, their session won't remain active indefinitely, reducing the risk of unauthorized access.
References:
* Secure SDLC practices emphasize the importance of security at every stage of the software development life cycle, including the implementation of proper session management controls12.
* Best practices for access control in security highlight the significance of managing session timeouts to prevent unauthorized access3.
* Industry standards and guidelines often recommend session timeouts as a critical security control to protect against unauthorized access4.
NEW QUESTION # 41
What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user?
- A. P3 low privacy risk
- B. P2 moderate privacy risk
- C. P1 high privacy risk
- D. P4 no privacy risk
Answer: C
Explanation:
The privacy impact rating for an application that stores personally identifiable information (PII), monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user would be P1 high privacy risk. Storing PII already poses a significant risk due to the potential for data breaches and misuse. Monitoring users and transferring data, even if anonymous, increases the risk as it involves ongoing data collection. Changing settings without user notification is a serious privacy concern because it can lead to unauthorized data processing or sharing, further elevating the risk level.
References:
* Practical Data Security and Privacy for GDPR and CCPA - ISACA1.
* Privacy risk assessment and privacy-preserving data monitoring2.
* How To Effectively Monitor Your Privacy Program: A New Series3.
NEW QUESTION # 42
Which security assessment deliverable identities unmanaged code that must be kept up to date throughout the life of the product?
- A. Metrics template
- B. List of third-party software
- C. Product risk profile
- D. Threat profile
Answer: B
Explanation:
The security assessment deliverable that identifies unmanaged code that must be kept up to date throughout the life of the product is the List of third-party software. Unmanaged code refers to code that does not run under the garbage-collected environment of the .NET Common Language Runtime, and it often includes legacy code, system libraries, or code written in languages that do not support automatic memory management. Keeping a list of third-party software is crucial because it helps organizations track dependencies and ensure they are updated, patched, and compliant with security standards. This is essential for maintaining the security posture of the software over time, as outdated components can introduce vulnerabilities.
References: The references provided from the web search results support the importance of monitoring and updating software components, including unmanaged code, as part of a secure software development lifecycle12.
NEW QUESTION # 43
Which architecture deliverable identifies the organization's tolerance to security issues and how the organization plans to react if a security issue occurs?
- A. Risk Mitigation Plan
- B. Business Requirements
- C. Policy Compliance Analysis
- D. Threat Modeling Artifacts
Answer: A
NEW QUESTION # 44
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?
- A. Intelligence
- B. Governance
- C. Software security development life cycle (SSDL) touchpoints
- D. Deployment
Answer: A
Explanation:
The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization's ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.
: The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework12345.
NEW QUESTION # 45
Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?
- A. Static
- B. Dynamic
- C. White box
- D. Black box
Answer: D
Explanation:
The software control test that examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output is known as black box testing. This testing method focuses on the functionality of the application rather than its internal structures or workings. Testers provide inputs and examine outputs without knowing how and where the inputs are worked upon. It's designed to test the system' s external behavior.
* Black box testing is used to verify that the system meets the requirements and behaves as expected in various scenarios, including edge cases and incorrect input data. It helps in identifying discrepancies between the system's actual functionality and its specified requirements.
* This type of testing is applicable across various levels of software testing, including unit, integration, system, and acceptance testing. It is particularly useful for validating user stories and use cases during the software development process.
* Since black box testing treats the software as a "black box", it does not require the tester to have knowledge of the programming languages or the system's implementation. This allows testers to objectively test the software's behavior and performance.
References: The concept of black box testing is well-documented and is a standard practice in secure software design, as outlined by sources such as LambdaTest1 and other industry best practices.
NEW QUESTION # 46
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:
Which technique should be used to detect this vulnerability without running the source codes?
- A. Fuzz testing
- B. Cross-site scripting
- C. Dynamic analysis
- D. Static analysis
Answer: D
Explanation:
Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code's structure, syntax, and data flow.
:
Static analysis as a means to identify security vulnerabilities1.
The importance of static analysis in the early stages of the SDLC to prevent security issues2.
Learning-based approaches to fix SQL injection vulnerabilities using static analysis3.
NEW QUESTION # 47
Company leadership has contracted with a security firm to evaluate the vulnerabilityofall externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
- A. Properly-based-testing
- B. Penetration testing
- C. Source-code fault injection
- D. Source-code analysis
Answer: B
Explanation:
The security testing technique that involves evaluating the vulnerability of all externally facing enterprise applications through both automated and manual system interactions is known as Penetration Testing. This method simulates real-world attacks on systems to identify potential vulnerabilities that could be exploited by attackers. It is a proactive approach to discover security weaknesses before they can be exploited in a real attack scenario. Penetration testing can include a variety of methods such as network scanning, application testing, and social engineering tactics to ensure a comprehensive security evaluation.
References: The concept of Penetration Testing as a method for evaluating vulnerabilities aligns with industry standards and practices, as detailed in resources from security-focused organizations and literature1.
NEW QUESTION # 48
Which security assessment deliverable identifies possible security vulnerabilities in the product?
- A. List of third-party software
- B. SDL project outline
- C. Metrics template
- D. Threat profile
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A Threat profile is a security assessment deliverable that outlines and identifies possible security vulnerabilities and threats relevant to a product. It includes categorization of threats, their potential impact, and vectors through which the product can be attacked. This deliverable is crucial for guiding mitigation and security testing efforts. Metrics templates (B) track progress or measurements, SDL project outline (C) documents phases and tasks in the secure development lifecycle, and the list of third-party software (D) catalogs external dependencies but does not specifically identify vulnerabilities. As per Microsoft SDL and OWASP Threat Modeling, the threat profile is a foundational deliverable in risk assessment and vulnerability identification.
References:
Microsoft Security Development Lifecycle (SDL) Documentation
OWASP Threat Modeling Guide
NIST SP 800-154: Guide to Data-Centric System Threat Modeling
NEW QUESTION # 49
Which secure software design principle states that it is always safer to require agreement of more than one entity to make a decision?
- A. Psychological Acceptability
- B. Total Mediation
- C. Separation of Privileges
- D. Least Privilege
Answer: C
NEW QUESTION # 50
What sitsbetween a browser and an internet connection and alters requests and responses in a way thedeveloper did not intend?
- A. Reverse engineering
- B. Intercept proxy
- C. Load testing
- D. Input validation
Answer: B
Explanation:
An intercept proxy, also known as a proxy server, sits between a web client (such as a browser) and an external server to filter, monitor, or manipulate the requests and responses passing through it. This can be used for legitimate purposes, such as security testing and user privacy, but it can also be exploited by attackers to alter web traffic in a way that the developer did not intend, potentially leading to security vulnerabilities.
References:
* Understanding of HTTP and HTTPS protocols12.
* Definition and role of proxy servers3.
NEW QUESTION # 51
Which threat modeling methodology involves creating or using collections of similar threats?
- A. Security Profile
- B. Attack Libraries
- C. Data Flow Diagrams
- D. Attack Trees
Answer: B
NEW QUESTION # 52
......
WGU Secure-Software-Design Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
Updated Secure-Software-Design Dumps Questions Are Available For Passing WGU Exam: https://www.vce4plus.com/WGU/Secure-Software-Design-valid-vce-dumps.html
New Secure-Software-Design Dumps For Preparing Courses and Certificates Certified WGU Exam Well: https://drive.google.com/open?id=1fg6QnyRUPdpbAWp45pbwsKtXozYl0T-k