Secure-Software-Design Practice Exam Questions and Answers

Senior IT staff has determined that a new product will be hosted in the cloud and will support web and mobile users. Developers will need to deliver secure REST services. Android and IOS mobile apps. and a web application. Developers are currently determining how to deliver each part of the overall product.

Which phase of the software development lifecycle (SDLC) is being described?

Credit card numbers are encrypted when stored in the database but are automatically decrypted when data is fetched. The testing tool intercepted the GET response, and testers were able to view credit card numbers as clear text.

How should the organization remediate this vulnerability?

Which mitigation technique can be used to fight against a denial of service threat?

Which secure coding practice uses role-based authentication where department-specific credentials will authorize department-specific functionality?

Which threat modeling approach concentrates on things the organization wants to protect?

The software security team prepared a report of necessary coding and architecture changes identified during the security assessment.

Which design and development deliverable did the team prepare?

Which question reflects the security change management component of the change management process?

Which mitigation technique is used to fight against an identity spoofing threat?

A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?

Which threat modeling step collects exploitable weaknesses within the product?