The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has just released a new firmware update for its line of smart thermostats. The operations team is now responsible for monitoring the devices for security issues, applying future patches, and ensuring that the update distribution mechanism itself is secure. Which SDL practice is the operations team carrying out?

   • AManage the Security Risk of Third-Party Components
   • BEstablish a Secure Incident Response Process
   • CEnsure Release and Operations Security
   • DConduct Final Security Review
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an activity that falls under 'Release and Operations Security'?

   • ASelecting cryptographic algorithms.
   • BPerforming threat modeling.
   • CApplying security patches to the software after deployment.
   • DWriting the initial security requirements.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A team is developing a smart-home hub that uses a third-party Zigbee stack. They have discovered that the stack has a known vulnerability that is not yet patched by the vendor. The product is scheduled to launch in two months. The team must decide whether to ship with the vulnerable component, replace it with a different stack, or delay the launch. The security lead is concerned about the risk, but the product manager is worried about the cost and schedule impact. Which action best aligns with the SDL's third-party component risk management practice?

   • AShip with the vulnerable stack and plan to patch it after launch
   • BRemove the Zigbee functionality from the product
   • CShip with the vulnerable stack but add a compensating control
   • DReplace the vulnerable stack with a different, more secure stack, even if it causes a delay
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following best describes the Microsoft Secure Development Lifecycle (SDL)?

   • AA compliance checklist that only applies to Microsoft products and cannot be used by other organizations.
   • BA set of 12 practices that integrate security and privacy considerations into every phase of software development, from training through release and operations.
   • CA set of guidelines for securing network infrastructure and cloud services, not directly related to software development.
   • DA framework that focuses exclusively on penetration testing after software is deployed to production.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a cryptographic standard that might be defined in this practice?

   • AUse AES-256 for symmetric encryption.
   • BUse a simple XOR cipher for obfuscation.
   • CUse a custom algorithm developed in-house.
   • DUse base64 encoding for encryption.
   Reveal Solution Discussion Select an answer first