A development team is starting a new project for a connected medical device. The organization has a list of approved IDEs, compilers, and static analysis tools that have been vetted for security. The team lead instructs everyone to use only these tools and to avoid downloading unapproved plugins. Which SDL practice is being followed?

Manage the Security Risk of Third-Party Components

What is the focus of the 'Ensure Release and Operations Security' practice in the Microsoft SDL?

To maintain security during release and ongoing operations of the software.

To select cryptographic standards.

To define security requirements for the project.

What is the main purpose of the 'Define Metrics and Compliance Reporting' practice in the Microsoft SDL?

To define the exact cryptographic algorithms to be used in the product.

To conduct a final security review before release.

To track security compliance and measure the effectiveness of security activities.

To train developers on secure coding practices.

Which of the following is an example of a security testing activity?

Fuzzing the application with malformed inputs to find crashes.

Setting up the development environment.

In the Microsoft SDL, what is the purpose of the 'Define Security Requirements' practice?

To create a list of all possible security vulnerabilities in the software.

To establish security and privacy requirements based on business needs and regulatory obligations.

To conduct penetration testing to verify that requirements are met.

To select the cryptographic algorithms to be used in the product.

EC-CouncilIoT Security Essentials

Domain 6Objective 3

The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 12)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 64 practice questions to prepare you well beyond it. (estimate)

64questions here

13free pages

13concepts

13 Concepts in This Objective

Overview of the 12 practices
Practice 1: Training
Practice 2: Define Security Requirements
Practice 3: Define Metrics and Compliance Reporting
Practice 4: Perform Threat Modeling
Practice 5: Establish Design Requirements
Practice 6: Define and Use Cryptography Standards
Practice 7: Manage the Security Risk of Third-Party Components
Practice 8: Use Approved Tools
Practice 9: Perform Security Testing
Practice 10: Establish a Secure Incident Response Process
Practice 11: Conduct Final Security Review
Practice 12: Ensure Release and Operations Security

Questions 56–60

56application · medium
A development team is starting a new project for a connected medical device. The organization has a list of approved IDEs, compilers, and static analysis tools that have been vetted for security. The team lead instructs everyone to use only these tools and to avoid downloading unapproved plugins. Which SDL practice is being followed?
Select an answer first
57foundation · easy
What is the focus of the 'Ensure Release and Operations Security' practice in the Microsoft SDL?
Select an answer first
58foundation · easy
What is the main purpose of the 'Define Metrics and Compliance Reporting' practice in the Microsoft SDL?
Select an answer first
59foundation · easy
Which of the following is an example of a security testing activity?
Select an answer first
60foundation · easy
In the Microsoft SDL, what is the purpose of the 'Define Security Requirements' practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.