The 12 Practices of the Microsoft Secure Development Lifecycle ISE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the focus of the 'Establish Design Requirements' practice in the Microsoft SDL?

   • ATo define the cryptographic standards to be used.
   • BTo train developers on secure coding.
   • CTo conduct security testing on the final product.
   • DTo incorporate security design requirements into the software architecture.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A team is designing a new IoT device that will be deployed in a hostile environment where physical tampering is likely. They have created a threat model that identifies the device's debug port as a high-risk attack surface. The team is now deciding on mitigation strategies. The product manager wants to keep the debug port for field troubleshooting, but the security lead argues that it should be physically disabled. The team must balance the need for field support with the security risk. Which approach best aligns with the SDL's threat modeling and design requirements practices?

   • AKeep the debug port but require a physical key to access it
   • BKeep the debug port but add a firmware password
   • CRemove the debug port from the threat model
   • DDisable the debug port in production and rely on remote diagnostics
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An IoT medical device transmits patient vitals from a bedside monitor to a central server. The development team must select a cryptographic approach to protect data in transit and at rest. The compliance team requires that the device support future key rotation without firmware replacement. Which approach best aligns with SDL cryptography standards?

   • AUse TLS 1.2 with RC4 for backward compatibility with older hospital infrastructure
   • BUse TLS 1.3 for network communication and AES-256-GCM for local storage, with a key hierarchy that allows remote key updates
   • CUse a proprietary encryption algorithm to avoid known vulnerabilities in public standards
   • DEncrypt data only at rest using AES-128-CBC, and rely on the private network for transit security
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A startup is developing a consumer IoT device that will collect health data. The company must comply with GDPR and industry privacy standards. The product manager asks the security team to define what security and privacy protections the device must include. Which SDL practice should be applied?

   • ADefine security and privacy requirements based on business and regulatory needs
   • BSelect cryptographic standards for data protection
   • CPerform threat modeling to identify privacy threats
   • DEstablish metrics and compliance reporting to track GDPR adherence
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is an example of a security design requirement?

   • AThe system must have a responsive user interface.
   • BThe system must be deployed on Azure.
   • CThe system must be written in C#.
   • DThe system must use a defense-in-depth approach with multiple layers of security controls.
   Reveal Solution Discussion Select an answer first