The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of a security requirement that might be defined in the 'Define Security Requirements' practice?

   • AThe application must encrypt all sensitive data in transit using TLS 1.2 or higher.
   • BThe application must be developed using the Java programming language.
   • CThe application must have a user-friendly interface.
   • DThe application must be deployed on Azure.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is security training for developers and stakeholders considered the first practice in the Microsoft SDL?

   • AIt ensures that everyone involved understands security fundamentals and can apply them throughout the development process.
   • BIt is required only for external stakeholders, not internal developers.
   • CIt replaces the need for any other security practices in the SDL.
   • DIt focuses solely on compliance with regulatory standards, not on practical security skills.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A medical device manufacturer is developing a new insulin pump that will connect to a smartphone app via Bluetooth. The team has completed initial security training and is now defining the system architecture. During a design review, the lead engineer asks the team to identify potential attack vectors such as unauthorized pairing, command injection, and denial-of-service through battery drain. Which SDL practice is the team applying?

   • ADefine Security Requirements
   • BPerform Security Testing
   • CPerform Threat Modeling
   • DUse Approved Tools
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A team is about to release a new version of a smart-home hub firmware. Before release, they run a suite of automated security tests, including fuzzing of the network interfaces and static analysis of the code. They also perform manual penetration testing on the device. Which SDL practice is the team performing?

   • AConduct Final Security Review
   • BUse Approved Tools
   • CDefine Metrics and Compliance Reporting
   • DPerform Security Testing
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is typically checked during the final security review?

   • AThe user interface is visually appealing.
   • BThe code is written in the latest programming language.
   • CThe project is within budget.
   • DAll security requirements have been implemented and tested.
   Reveal Solution Discussion Select an answer first