The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An IoT company is using a third-party real-time operating system (RTOS) in its new line of smart meters. The RTOS vendor has announced that it will no longer provide security patches after next year. The company must decide how to handle this risk while continuing to meet regulatory compliance. Which action is most aligned with SDL Practice 7?

   • AContinue using the RTOS and rely on the fact that no vulnerabilities have been found yet
   • BPlan to migrate to a supported RTOS before the end-of-life date, and in the meantime implement compensating controls
   • CPurchase a perpetual license to extend support indefinitely
   • DHide the RTOS version from the public to reduce the risk of targeted attacks
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team developing a smart-lock product needs to encrypt communication between the lock and the mobile app. They are evaluating different encryption algorithms and key management approaches. The security lead insists that they use a well-established algorithm with a sufficient key length and that they avoid proprietary or homegrown crypto. Which SDL practice is the team following?

   • AEstablish Design Requirements
   • BDefine Security Requirements
   • CUse Approved Tools
   • DDefine and Use Cryptography Standards
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A team is preparing for the final security review of a smart-lock product. The security lead has compiled the threat models, security test results, and the list of known vulnerabilities. The product manager is pressuring the team to skip the review to meet a launch deadline. The security lead must decide how to proceed. Which action best aligns with the SDL's final security review practice?

   • AAsk the product manager to sign off on the review without performing it
   • BPerform a shortened review that only checks critical vulnerabilities
   • CPerform the full review and document any residual risk for management approval
   • DSkip the review to meet the launch deadline
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has released a new firmware update for its smart thermostat product. The update includes a new third-party library for cloud connectivity. After the release, the operations team discovers that the library has a critical vulnerability. The team must decide how to respond. Which action best aligns with the SDL's release and operations security practice?

   • ANotify customers but do not provide a fix
   • BImmediately release an emergency patch that removes or mitigates the vulnerable library
   • CWait for the next scheduled update to fix the vulnerability
   • DIgnore the vulnerability because it is in a third-party library
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the main concern of the 'Manage the Security Risk of Third-Party Components' practice?

   • ATo assess and manage security risks introduced by third-party libraries and components.
   • BTo train developers on secure coding.
   • CTo conduct final security review.
   • DTo define the cryptographic standards for the project.
   Reveal Solution Discussion Select an answer first