Online Access Free Secure-Software-Design Practice Test

The final security review determined that two low-risk security issues identified in testing are still outstanding. Developers have assured the security team that both issues can be resolved quickly once they have time to fix them. The security team is confident that developers can fix the flaws in the first post-release patch.
What is the result of the final security review?

• A.Not Passed and Requires Escalation
• B.Not Passed but Does Not Require Escalation
• C.Passed with Exceptions
• D.Passed

The security team contracts with an independent security consulting firm to simulate attacks on deployed products and report results to organizational leadership.
Which category of secure software best practices is the team performing?

• A.Architecture analysis
• B.Penetration testing
• C.Code review
• D.Attack models

Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?

• A.Ensure credentials and authentication tokens are encrypted during transit
• B.Ensure strong password policies are enforced
• C.Ensure authentication controls are resistant to brute force attacks
• D.Ensure passwords are encrypted when stored in persistent data stores

What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user?

• A.P4 no privacy risk
• B.P2 moderate privacy risk
• C.P1 high privacy risk
• D.P3 low privacy risk

The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one- time requirements, bucket requirements, and final security review requirements.
Which type of requirement slates that the team must identify primary security and privacy contacts?

• A.One-time requirement
• B.Final security review requirement
• C.Every-sprint requirement
• D.Bucket requirement