The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 13)

Questions 61–64

1. 61application · medium

   A company is adopting the SDL for the first time. The security team wants to ensure that all developers, testers, and product managers understand common vulnerabilities such as buffer overflows and insecure direct object references, as well as the company's secure coding standards. They plan to require annual completion of a security awareness course and role-specific training. Which SDL practice is the company implementing?

   • AUse Approved Tools
   • BDefine Security Requirements
   • CTraining
   • DPerform Security Testing
   Reveal Solution Discussion Select an answer first
2. 62foundation · easy

   What is the purpose of the 'Define and Use Cryptography Standards' practice in the Microsoft SDL?

   • ATo select and implement appropriate cryptographic standards for data protection.
   • BTo define security requirements for the project.
   • CTo conduct threat modeling.
   • DTo perform security testing.
   Reveal Solution Discussion Select an answer first
4. 63foundation · easy

   What is the purpose of the 'Establish a Secure Incident Response Process' practice in the Microsoft SDL?

   • ATo select cryptographic standards.
   • BTo develop a structured incident response plan to handle security breaches.
   • CTo conduct security testing.
   • DTo define security requirements for the project.
   Reveal Solution Discussion Select an answer first
5. 64application · medium

   A development team is integrating an open-source library for parsing JSON in a new IoT gateway. The library has a known critical vulnerability, but a patched version is available. The team is under pressure to meet a release deadline. According to SDL Practice 7, what is the most appropriate action?

   • AUpdate to the patched version and verify it passes the project's security tests
   • BUse the vulnerable version but add a network firewall rule to block external JSON input
   • CReplace the library with a custom JSON parser written in-house
   • DAccept the risk and document it in the release notes
   Reveal Solution Discussion Select an answer first