The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A team is about to release a new version of a smart thermostat's firmware. The QA lead wants to ensure that security testing has been performed and that no known critical vulnerabilities remain. Which action best fulfills SDL Practice 9?

   • ADelay the release until a third-party audit can be scheduled
   • BRun a combination of static analysis, dynamic fuzzing, and penetration testing on the firmware, and verify that all critical findings are fixed
   • CRun only a unit test suite that checks functional behavior
   • DAsk the development team to self-certify that the code is secure
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company that manufactures smart doorbells has just experienced a data breach that exposed customer video footage. The incident response team is activated, but they realize that their incident response plan is outdated and does not cover cloud-based components. The team must respond to the breach while also updating the plan. Which approach best aligns with the SDL's incident response and operations security practices?

   • ARely on the cloud provider's incident response team and do nothing
   • BFocus only on containing the breach and ignore the outdated plan
   • CFollow the existing plan as closely as possible and update it after the incident
   • DStop the incident response and first rewrite the entire plan
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An IoT wearable device is being designed to store health data locally and sync with a smartphone app. The architecture team must decide how to protect the data if the device is lost or stolen. Which design requirement aligns with SDL Practice 5?

   • AObfuscate the data format to make it unreadable without the app
   • BRequire full-disk encryption on the device's flash storage with a hardware-backed key
   • CRely on the smartphone app's screen lock to protect the data
   • DStore all health data only in the cloud and never on the device
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following activities is typically part of threat modeling?

   • AConducting user acceptance testing.
   • BIdentifying assets, entry points, and potential attackers.
   • CSetting up a firewall for the production network.
   • DWriting secure code for the application.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A smart-lock firmware team is about to start coding a new feature that accepts OTA update commands over MQTT. The team lead wants to identify potential abuse cases before any code is written. Which SDL practice should be initiated first to systematically enumerate threats such as spoofed update servers or replay attacks?

   • AProvide security training on OTA update best practices
   • BConduct security testing on the MQTT message parser
   • CPerform threat modeling on the OTA update feature
   • DDefine security requirements for the MQTT broker
   Reveal Solution Discussion Select an answer first