In the Microsoft SDL, which practice is typically performed first in the development lifecycle?

Release and Operations Security

What is the purpose of the 'Use Approved Tools' practice in the Microsoft SDL?

To define security requirements for the project.

To utilize approved and secure development tools to minimize vulnerabilities.

A company is developing a new IoT sensor that will transmit health data. They must comply with a regulation that requires strong encryption for data in transit. The team is evaluating whether to use a well-known cryptographic library or to implement a custom algorithm to reduce code size. The security lead warns that custom crypto is risky, but the firmware engineer argues that the library is too large for the device's limited memory. Which decision best aligns with the SDL's cryptography standards and third-party component practices?

Implement a custom algorithm that is smaller and meets the regulatory requirement

Use the well-known library even if it requires a larger memory footprint

Delay the decision until after the final security review

Use the library but only for the key exchange, and use custom crypto for the data encryption

A company has hired several new developers to work on an IoT platform. The developers have little security experience and are unfamiliar with secure coding practices. The security manager wants to reduce the likelihood of introducing vulnerabilities. Which action best aligns with SDL Practice 1?

Provide role-based security training to all developers and stakeholders

Hire an external security consultant to audit the code before release

Require all code to be reviewed by a senior developer

Purchase a static analysis tool and run it on all code

A development team has completed all SDL practices for a new IoT device, including threat modeling, security testing, and incident response planning. The final security review is scheduled. However, the team discovers a new critical vulnerability in a third-party library that is used in the device. What should the team do?

Proceed with the release and patch the vulnerability in a future update

Remove the third-party library and rewrite the functionality from scratch

Document the vulnerability in the release notes and proceed

Delay the release until the vulnerability is patched or a mitigating control is implemented and verified

EC-CouncilIoT Security Essentials

Domain 6Objective 3

The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 3)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 64 practice questions to prepare you well beyond it. (estimate)

64questions here

13free pages

13concepts

13 Concepts in This Objective

Overview of the 12 practices
Practice 1: Training
Practice 2: Define Security Requirements
Practice 3: Define Metrics and Compliance Reporting
Practice 4: Perform Threat Modeling
Practice 5: Establish Design Requirements
Practice 6: Define and Use Cryptography Standards
Practice 7: Manage the Security Risk of Third-Party Components
Practice 8: Use Approved Tools
Practice 9: Perform Security Testing
Practice 10: Establish a Secure Incident Response Process
Practice 11: Conduct Final Security Review
Practice 12: Ensure Release and Operations Security

Questions 11–15

11foundation · easy
In the Microsoft SDL, which practice is typically performed first in the development lifecycle?
Select an answer first
12foundation · easy
What is the purpose of the 'Use Approved Tools' practice in the Microsoft SDL?
Select an answer first
13expert · hard
A company is developing a new IoT sensor that will transmit health data. They must comply with a regulation that requires strong encryption for data in transit. The team is evaluating whether to use a well-known cryptographic library or to implement a custom algorithm to reduce code size. The security lead warns that custom crypto is risky, but the firmware engineer argues that the library is too large for the device's limited memory. Which decision best aligns with the SDL's cryptography standards and third-party component practices?
Select an answer first
14application · medium
A company has hired several new developers to work on an IoT platform. The developers have little security experience and are unfamiliar with secure coding practices. The security manager wants to reduce the likelihood of introducing vulnerabilities. Which action best aligns with SDL Practice 1?
Select an answer first
15expert · hard
A development team has completed all SDL practices for a new IoT device, including threat modeling, security testing, and incident response planning. The final security review is scheduled. However, the team discovers a new critical vulnerability in a third-party library that is used in the device. What should the team do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 3)

Questions 11–15

In the Microsoft SDL, which practice is typically performed first in the development lifecycle?

What is the purpose of the 'Use Approved Tools' practice in the Microsoft SDL?

A company has hired several new developers to work on an IoT platform. The developers have little security experience and are unfamiliar with secure coding practices. The security manager wants to reduce the likelihood of introducing vulnerabilities. Which action best aligns with SDL Practice 1?

Keep studying — IoT Incident Response and Security Engineering