The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the main goal of the 'Perform Security Testing' practice in the Microsoft SDL?

   • ATo train developers on secure coding.
   • BTo identify and fix vulnerabilities before release.
   • CTo select cryptographic standards.
   • DTo define security requirements for the project.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A team is developing a new IoT device and has completed the security testing phase. The test results show that all critical and high-severity vulnerabilities have been fixed, but there are several medium-severity issues that remain open. The product manager wants to release on schedule, but the security lead is concerned about the open issues. The team must decide whether to release or delay. Which decision best aligns with the SDL's security testing and final security review practices?

   • ARelease but document the open issues and obtain a formal risk acceptance from management
   • BSkip the final security review and release immediately
   • CDelay the release until all medium-severity issues are fixed
   • DRelease on schedule because only medium-severity issues remain
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Before a smart-lock firmware is approved for release, the security lead reviews the threat models, security test results, and the list of known vulnerabilities to confirm that all security requirements have been met and that no critical issues remain open. This review is the last step before the release decision. Which SDL practice is being performed?

   • ADefine Metrics and Compliance Reporting
   • BConduct Final Security Review
   • CEnsure Release and Operations Security
   • DPerform Security Testing
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A smart agriculture company has deployed thousands of soil sensors that communicate over a cellular network. The operations team has noticed unusual traffic patterns from some sensors, indicating possible compromise. The company must respond while maintaining service availability for the rest of the fleet. Which approach best balances security and operations?

   • AShut down the entire sensor network until the cause is identified
   • BPush a new firmware update to all sensors immediately without analysis
   • CIsolate the affected sensors, analyze the traffic, and apply a firmware update or configuration change to mitigate the issue
   • DIgnore the unusual traffic because the sensors are still reporting data
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large IoT manufacturer wants to ensure that all product lines meet the same security baseline. The security team has defined requirements, but different product teams interpret them differently. The leadership wants a way to compare security posture across products and identify teams that need improvement. Which approach best aligns with SDL Practice 3?

   • ACreate a single security requirements document and share it with all teams
   • BAsk each product team to self-report their security status in a free-form email
   • CDefine standardized security metrics and a common reporting dashboard that all product teams must use
   • DConduct a security audit of each product at the end of the year
   Reveal Solution Discussion Select an answer first