Secure-Software-Design Exam Study Guide Free Practice Test LAST UPDATED DATE Apr 10, 2025
The New Secure-Software-Design 2025 Updated Verified Study Guides & Best Courses
NEW QUESTION # 52
The security team has a library of recorded presentations that are required viewing tor all new developers in the organization. The video series details organizational security policies and demonstrates how to define, test for. and code tor possible threats.
Which category of secure software best practices does this represent?
- A. Architecture analysis
- B. Training
- C. Attack models
- D. Code review
Answer: B
Explanation:
The category of secure software best practices being described is Training. This is because the focus is on educating new developers about organizational security policies and coding practices to mitigate potential threats. Training is a proactive approach to ensure that developers are aware of security concerns and are equipped with the knowledge to address them in their coding practices.
References: The importance of training in secure software best practices is supported by industry resources such as the SAFECode's "Fundamental Practices for Secure Software Development" which emphasizes the need for application security control definition and management1, and the NIST's Secure Software Development Framework (SSDF) which recommends integrating secure development practices throughout the software development lifecycle2. Additional support for this category can be found in resources detailing effective secure development practices345.
NEW QUESTION # 53
The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.
Which security testing technique is being used?
- A. Fuzz testing
- B. Binary code analysis
- C. Binary fault injection
- D. Dynamic code analysis
Answer: A
Explanation:
Fuzz testing is the ideal technique in this scenario. Here's why:
* Focus on Integrations: The scenario emphasizes testing links between the software, databases, web servers, and web services. Fuzz testing is specifically designed to find vulnerabilities in how software handles data and communication between components.
* Pre-release Testing: The product being close to release indicates a critical need to identify security flaws before public deployment. Fuzz testing is effective in uncovering unexpected behavior and potential vulnerabilities.
* Fuzz Testing Targets: Fuzz testing works by injecting invalid or unexpected data into interfaces (like those between databases, web components, etc.) to observe how the software reacts. This helps expose potential security gaps and weaknesses.
NEW QUESTION # 54
Which design and development deliverable contains the results of each type of evaluation that was performed and the type and number of vulnerabilities discovered?
- A. Remediation report
- B. Privacy compliance report
- C. Security test execution report
- D. Security testing reports
Answer: D
Explanation:
Security testing reports are the deliverables that typically contain detailed results of the security evaluations performed. These reports include the types of tests conducted, such as static and dynamic analysis, penetration testing, and code reviews, as well as the number and types of vulnerabilities discovered. The purpose of these reports is to document the security posture of the software at the time of testing and to provide a basis for remediation efforts.
References: The information aligns with best practices in secure software development, which emphasize the importance of documenting security requirements and conducting risk analysis during the design phase to identify and mitigate vulnerabilities early in the SDLC12.
NEW QUESTION # 55
What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user?
- A. P3 low privacy risk
- B. P4 no privacy risk
- C. P2 moderate privacy risk
- D. P1 high privacy risk
Answer: D
Explanation:
The privacy impact rating for an application that stores personally identifiable information (PII), monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user would be P1 high privacy risk. Storing PII already poses a significant risk due to the potential for data breaches and misuse. Monitoring users and transferring data, even if anonymous, increases the risk as it involves ongoing data collection. Changing settings without user notification is a serious privacy concern because it can lead to unauthorized data processing or sharing, further elevating the risk level.
References:
* Practical Data Security and Privacy for GDPR and CCPA - ISACA1.
* Privacy risk assessment and privacy-preserving data monitoring2.
* How To Effectively Monitor Your Privacy Program: A New Series3.
NEW QUESTION # 56
Credit card numbers are encrypted when stored in the database but are automatically decrypted when data is fetched. The testing tool intercepted the GET response, and testers were able to view credit card numbers as clear text.
How should the organization remediate this vulnerability?
- A. Never cache sensitive data
- B. Ensure all data in transit is encrypted
- C. Ensure there is an audit trail for all sensitive transactions
- D. Enforce role-based authorization controls in all application layers
Answer: B
Explanation:
The core issue here is cleartext transmission of sensitive data, and option C directly addresses this:
* Addressing the Problem: The scenario reveals the vulnerability is the lack of encryption during data transmission (the GET response). Ensuring encryption in transit fixes this specific exploit.
* Transport Layer Security: Encryption during transit is typically achieved through protocols like TLS (HTTPS), preventing the interception of sensitive information.
NEW QUESTION # 57
What are the eight phases of the software development lifecycle (SDLC)?
- A. Plan, gather requirements, identify attack surface, design, write code, perform code reviews, test, deploy
- B. Gather requirements, prototype, perform threat modeling, write code, test, user acceptance testing, deploy, maintain
- C. Planning, security analysis, requirement analysis, design, implementation, threat mitigation, testing, maintenance
- D. Planning, requirements, design, implementation, testing, deployment, maintenance, end of life
Answer: D
NEW QUESTION # 58
Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure strong password policies are enforced
- B. Ensure authentication controls are resistant to brute force attacks
- C. Ensure credentials and authentication tokens are encrypted during transit
- D. Ensure passwords are encrypted when stored in persistent data stores
Answer: B
NEW QUESTION # 59
Company leadership has contracted with a security firm to evaluate the vulnerabilityofall externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
- A. Source-code fault injection
- B. Source-code analysis
- C. Properly-based-testing
- D. Penetration testing
Answer: D
Explanation:
The security testing technique that involves evaluating the vulnerability of all externally facing enterprise applications through both automated and manual system interactions is known as Penetration Testing. This method simulates real-world attacks on systems to identify potential vulnerabilities that could be exploited by attackers. It is a proactive approach to discover security weaknesses before they can be exploited in a real attack scenario. Penetration testing can include a variety of methods such as network scanning, application testing, and social engineering tactics to ensure a comprehensive security evaluation.
References: The concept of Penetration Testing as a method for evaluating vulnerabilities aligns with industry standards and practices, as detailed in resources from security-focused organizations and literature1.
NEW QUESTION # 60
The software security team is performing security testing on a new software product using a testing tool that scans the running application for known exploit signatures.
Which security testing technique is being used?
- A. Automated vulnerability scanning
- B. Source-code analysis
- C. Penetration testing
- D. Properly-based testing
Answer: A
Explanation:
The security testing technique that involves using a testing tool to scan a running application for known exploit signatures is known as Automated Vulnerability Scanning. This method is part of dynamic analysis, which assesses the software in its running state to identify vulnerabilities that could be exploited by attackers. Automated vulnerability scanning tools are designed to detect and report known vulnerabilities bycomparing the behavior and outputs of the application against a database of known exploit signatures1.
References: 1: Application Security Testing: Tools, Types and Best Practices | GitHub
NEW QUESTION # 61
The product security incident response team (PSIRT) has decided to make a formal public disclosure, including base and temporal common vulnerability scoring system (CVSS) scores and a common vulnerabilities and exposures (CVE) ID report, of an externally discovered vulnerability.
What is the most likely reason for making a public disclosure?
- A. The potential for increased public awareness of a vulnerability is probable, which could lead to higher risk for customers.
- B. The response team has determined that the vulnerability is credible.
- C. The vulnerability reporter has threatened to make the finding public after being notified that their case was not credible.
- D. Notification of a vulnerability from an external party has occurred.
Answer: B
NEW QUESTION # 62
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure.
Which security testing technique is being used?
- A. Dynamic Code Analysis
- B. Source-Code Fault Injection
- C. Fuzz Testing
- D. Binary Fault Injection
Answer: B
NEW QUESTION # 63
A public library needs to implement security control on publicly used computers to prevent illegal downloads.
Which security control would prevent this threat?
- A. Integrity
- B. Nonrepudiation
- C. Availability
- D. Authentication
Answer: D
Explanation:
Authentication is the most effective control for the scenario because it directly addresses who is using the public computers:
* User Identification: Authentication requires users to identify themselves (e.g., library card, login credentials) before accessing the computers. This links actions to specific individuals, making it easier to control unauthorized activity.
* Policy Enforcement: Combined with other controls (e.g., content filtering), authentication enables the library to implement policies restricting downloads. If users violate the policy, their identities can be used for consequences.
* Deterrent: Knowing they can be identified discourages users from attempting illegal downloads.
NEW QUESTION # 64
During fuzz testing of the new product, an exception was thrown on the order entry view, which caused a full stack dump to be displayed in the browser window that included function names from the source code.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure sensitive information is scrubbed from all error messages
- B. Ensure all exceptions are handled in a standardized way
- C. Ensure private information is not logged
- D. Ensure privileges are restored after application exceptions
Answer: B
NEW QUESTION # 65
Which mitigation technique is used to fight against an identity spoofing threat?
- A. Filtering
- B. Audit trails
- C. Encryption
- D. Require user authorization
Answer: D
Explanation:
To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization.
This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for attackers to spoof an identity successfully.
References:
* Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.
* The National Security Agency's guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures2.
* Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks3.
* The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud4.
NEW QUESTION # 66
Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?
- A. Data Protection
- B. General Coding Practices
- C. Session Management
- D. Authentication and Password Management
Answer: B
NEW QUESTION # 67
The security team has received notice of an insecure direct object reference vulnerability in a third-party component library that could result in remote code execution. The component library was replaced and is no longer being used within the application.
How should the organization remediate this vulnerability?
- A. Ensure Auditing and Logging Is Enabled on All Servers
- B. Ensure Sensitive Information Is Not Logged
- C. Enforce the Removal of Unused Dependencies
- D. Access to Configuration Files Is Limited to Administrators
Answer: C
NEW QUESTION # 68
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?
- A. Input validation
- B. Authentication
- C. Data protection
- D. Access control
Answer: D
Explanation:
The secure coding practice being described is Access Control. This practice ensures that access to data and features within a system is restricted and controlled. The description given indicates that the product has mechanisms to prevent the display of personally identifiable information (PII), restrict the printing of private documents, and require elevated privileges to access archived documents. These are all measures to control who has access to what data and under what circumstances, which is the essence of access control.
References:
* ISO/IEC 27018 Code of Practice for Protecting Personal Data in the Cloud1.
* NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)2.
* ISO/IEC 29151:2017, Code of practice for personally identifiable information protection3.
NEW QUESTION # 69
The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one-time requirements, bucket requirements, and final security review requirements.
Which type of requirement slates that the team must identify primary security and privacy contacts?
- A. One-time requirement
- B. Bucket requirement
- C. Final security review requirement
- D. Every-sprint requirement
Answer: A
Explanation:
The OpenSAMM business function being assessed is Verification. This function involves activities related to reviewing and testing to ensure that the software meets the requiredsecurity standards and practices. In the context of the question, the software security group's focus on reviewing design artifacts to ensure compliance with organizational security standards falls under the Verification function. This includes tasks such as design review, implementation review, and security testing, which are all aimed at verifying that the security measures and controls are correctly integrated into the software design.
References: The information is verified as per the OWASP SAMM documentation, which outlines the Verification function as a core business function that encompasses activities like design review, which is directly related to the assessment of design artifacts mentioned in the question1.
NEW QUESTION # 70
A company is moving forward with a new product. Product scope has been determined, teams have formed, and backlogs have been created. Developers areactively writing code for the new product, with one team concentrating on delivering data via REST services, one Team working on the mobile apps, and a third team writing the web application.
Which phase of the software developmentlifecycle(SDLC) is being described?
- A. Requirements
- B. Design
- C. Deployment
- D. Implementation
Answer: D
Explanation:
The phase being described is the Implementation phase of the SDLC. During this phase, the actual development starts, and the product begins to be built. The teams are actively writing code, which is a key activity of the Implementation phase. This phase involves translating the design and specifications into executable code, developing the software's features, and then integrating the various components into a full-fledged system.
References:
* The Software Development Life Cycle (SDLC): 7 Phases and 5 Models1.
* What Is the Software Development Life Cycle? SDLC Explained2.
* SDLC: 6 Main Stages of the Software Product Development Lifecycle3.
* Software Development Life Cycle (SDLC) Phases & Models4.
NEW QUESTION # 71
The security team is reviewing whether changes or open issues exist that would affect requirements for handling personal information documented in earlier phases of the development life cycle.
Which activity of the Ship SDL phase is being performed?
- A. Vulnerability scan
- B. Final security review
- C. Open-source licensing review
- D. Final privacy review
Answer: D
Explanation:
The activity being performed is the final privacy review. This step is crucial in the Ship phase of the Security Development Lifecycle (SDL), where the security team assesses if there are any changes or unresolved issues that could impact the requirements for handling personal information. These requirements are typically documented in the earlier stages of the development lifecycle, and the final privacy review ensures that the software complies with these requirements before release.
References: The explanation is based on the best practices outlined in the SDL Activities and Best Practices, which detail the importance of conducting a final privacy review during the Ship phase to ensure that all privacy issues have been addressed12.
NEW QUESTION # 72
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?
- A. Session management
- B. Data protection
- C. Access control
- D. Communication security
Answer: C
NEW QUESTION # 73
Which threat modeling step collects exploitable weaknesses within the product?
- A. Set the scope
- B. Analyze the target
- C. Rate threats
- D. Identify and document threats
Answer: D
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 74
Which mitigation technique can be used to light against a threat where a user may gain access to administrator level functionality?
- A. Hashes
- B. Run with least privilege
- C. Encryption
- D. Quality of service
Answer: B
Explanation:
The principle of running with the least privilege is a fundamental security concept that involves granting users only the permissions they need to perform their tasks and no more. This minimizes the risk of a user gaining access to administrator-level functionality that they are not authorized to use. By limiting the privileges of user accounts to the bare minimum necessary, the potential damage from various attacks, such as privilege escalation, is significantly reduced.
References: The concept of least privilege is widely recognized as a critical security measure. Resources like Exabeam's article on preventing privilege escalation and TechTarget's guide on privilege escalation attacks provide insights into how enforcing least privilege can mitigate such threats12. These sources verify that running with the least privilege is an effective mitigation technique against the threat of unauthorized access to elevated privileges.
NEW QUESTION # 75
......
Get Prepared for Your Secure-Software-Design Exam With Actual 106 Questions: https://www.practicevce.com/WGU/Secure-Software-Design-practice-exam-dumps.html
Authentic Secure-Software-Design Exam Dumps PDF - 2025 Updated: https://drive.google.com/open?id=1C27Ovgf6dwhesFqmNv9xnPeFzZQItCoF