A company building a smart-wearable device is using an open-source real-time operating system (RTOS) and a third-party Bluetooth stack. The security team wants to ensure these components do not introduce known vulnerabilities into the final product. They plan to inventory all third-party components, check for known vulnerabilities, and monitor for updates. Which SDL practice is the team applying?

Define Metrics and Compliance Reporting

Manage the Security Risk of Third-Party Components

Which of the following is a key activity in managing third-party component risk?

Maintaining an inventory of all third-party components and their versions.

Writing custom code to replace all third-party components.

Using only the latest version of every component without checking for vulnerabilities.

Ignoring third-party components because they are not part of the codebase.

A software team developing a fleet-management IoT platform wants to ensure that security requirements are consistently met across multiple product releases. They plan to track the percentage of features that have completed threat modeling, the number of open high-severity vulnerabilities, and the time to remediate them. They also want to report this data to management on a regular basis. Which SDL practice is the team implementing?

Establish a Secure Incident Response Process

Define Metrics and Compliance Reporting

Which of the following is a primary goal of the Training practice in the Microsoft SDL?

To focus only on executives and managers, not on individual developers.

To certify that all code is free from vulnerabilities before any training is delivered.

To ensure developers and stakeholders are aware of security risks and know how to mitigate them in their roles.

To replace the need for security testing by teaching developers to write perfect code.

A development team is building a mobile app for controlling smart locks. The team wants to use a third-party SDK for Bluetooth communication. The security lead insists that only approved tools and components be used. What should the team do first?

Ask the vendor for a copy of the SDK's source code to review manually

Check the SDK against the organization's approved tool list and perform a security review if it is not listed

Download the latest version of the SDK from the vendor's website and start coding

Use a different SDK that is already approved, even if it lacks needed features

EC-CouncilIoT Security Essentials

Domain 6Objective 3

The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 11)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 64 practice questions to prepare you well beyond it. (estimate)

64questions here

13free pages

13concepts

13 Concepts in This Objective

Overview of the 12 practices
Practice 1: Training
Practice 2: Define Security Requirements
Practice 3: Define Metrics and Compliance Reporting
Practice 4: Perform Threat Modeling
Practice 5: Establish Design Requirements
Practice 6: Define and Use Cryptography Standards
Practice 7: Manage the Security Risk of Third-Party Components
Practice 8: Use Approved Tools
Practice 9: Perform Security Testing
Practice 10: Establish a Secure Incident Response Process
Practice 11: Conduct Final Security Review
Practice 12: Ensure Release and Operations Security

Questions 51–55

51application · medium
A company building a smart-wearable device is using an open-source real-time operating system (RTOS) and a third-party Bluetooth stack. The security team wants to ensure these components do not introduce known vulnerabilities into the final product. They plan to inventory all third-party components, check for known vulnerabilities, and monitor for updates. Which SDL practice is the team applying?
Select an answer first
52foundation · easy
Which of the following is a key activity in managing third-party component risk?
Select an answer first
53application · medium
A software team developing a fleet-management IoT platform wants to ensure that security requirements are consistently met across multiple product releases. They plan to track the percentage of features that have completed threat modeling, the number of open high-severity vulnerabilities, and the time to remediate them. They also want to report this data to management on a regular basis. Which SDL practice is the team implementing?
Select an answer first
54foundation · easy
Which of the following is a primary goal of the Training practice in the Microsoft SDL?
Select an answer first
55application · medium
A development team is building a mobile app for controlling smart locks. The team wants to use a third-party SDK for Bluetooth communication. The security lead insists that only approved tools and components be used. What should the team do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 11)

Questions 51–55

Which of the following is a key activity in managing third-party component risk?

Which of the following is a primary goal of the Training practice in the Microsoft SDL?

A development team is building a mobile app for controlling smart locks. The team wants to use a third-party SDK for Bluetooth communication. The security lead insists that only approved tools and components be used. What should the team do first?

Keep studying — IoT Incident Response and Security Engineering