The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is preparing to test a new IoT device that will be deployed in a critical infrastructure environment. The device has a web interface and an API. The team has limited time and must decide which testing activities to prioritize. Which combination best aligns with SDL Practice 9?

   • APerform static analysis on the firmware, fuzz the API, and conduct a penetration test on the web interface
   • BRun only a vulnerability scanner on the web interface
   • CAsk the developers to perform a code walkthrough and mark the device as tested
   • DDefer all testing until after deployment to save time
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A team is designing a new IoT medical device that will be used in hospitals. The device communicates wirelessly and is subject to strict regulatory requirements. The team has limited time and budget. They must choose between performing a full threat model or conducting extensive security testing later. Which approach best aligns with SDL principles?

   • APerform a focused threat model early in design, then use security testing to validate the identified threats
   • BConduct threat modeling only after the final security review finds issues
   • CSkip threat modeling and rely on penetration testing after the prototype is built
   • DUse a generic threat model from a similar device without customizing it
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An IoT device manufacturer is designing a new home security camera. The device will store video locally and stream it to a cloud service. The architecture team must decide how to protect the video data both at rest and in transit. The device has limited processing power. Which design approach best aligns with SDL Practice 5?

   • AUse hardware-accelerated AES encryption for local storage and TLS for streaming, with a secure key management scheme
   • BStore video unencrypted on the device and rely on cloud encryption only
   • CUse TLS for local storage and AES for streaming, reversing the typical roles
   • DUse a lightweight custom encryption algorithm to save processing power
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company that produces smart meters has just experienced a security breach where an attacker exploited a vulnerability in the meter's web interface. The incident response team is activated, and they follow a predefined plan that includes containment, eradication, recovery, and post-incident review. Which SDL practice is being exercised?

   • ADefine Metrics and Compliance Reporting
   • BConduct Final Security Review
   • CEstablish a Secure Incident Response Process
   • DPerform Security Testing
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is preparing to release a new IoT hub. The security team has completed threat modeling, security testing, and incident response planning. Before the release, the team must ensure that all SDL practices were followed and that no critical security issues are open. Which SDL practice should be performed?

   • AUpdate the incident response plan based on the release
   • BConduct a final security review to verify that all required practices were completed and critical issues are resolved
   • CPerform another round of threat modeling to catch any missed threats
   • DDefine new security metrics to measure post-release performance
   Reveal Solution Discussion Select an answer first