The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key component of a secure incident response process?

   • AA focus only on external attackers, not insider threats.
   • BA plan to ignore minor incidents to save resources.
   • CA process that is only activated after the software is released.
   • DA clear escalation path and defined roles for incident responders.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a metric that might be used in the 'Define Metrics and Compliance Reporting' practice?

   • ANumber of cups of coffee consumed by the team.
   • BNumber of security bugs found during code review per module.
   • CNumber of user interface screens designed.
   • DNumber of lines of code written per day.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An industrial IoT gateway manufacturer is designing a new product that will collect sensor data and send it to a cloud dashboard. The architecture team has decided to use a hardware security module (HSM) for key storage, to implement secure boot, and to segment the network interfaces so that the management interface is isolated from the data interface. These decisions are being made before any code is written. Which SDL practice does this represent?

   • ADefine Security Requirements
   • BDefine and Use Cryptography Standards
   • CEstablish Design Requirements
   • DPerform Threat Modeling
   Reveal Solution Discussion Select an answer first
5. 9expert · hard · select all that apply

   A company is developing a new IoT device that will be sold globally. They must comply with different data protection regulations in different regions, including GDPR in Europe and CCPA in California. The security team is defining security requirements for the product. Which of the following actions are part of the SDL practice 'Define Security Requirements'? Select all that apply.

   • ASelect the encryption algorithm to be used for data at rest
   • BDocument the specific privacy requirements for each region
   • CEstablish metrics to track compliance with the requirements
   • DIdentify the security features that the device must have, such as secure boot
   • EDefine the data retention limits for customer data
   Check answers Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an approved tool that might be required by this practice?

   • AA compiler that is outdated and has known vulnerabilities.
   • BA static code analysis tool that is on the organization's approved list.
   • CA text editor that is not commonly used by the team.
   • DA custom build script that is not reviewed for security.
   Reveal Solution Discussion Select an answer first