Secure Software Development

Q1. What is a software vulnerability?

1. A.A routine patch applied to update and improve existing system software
2. B.A category of self-replicating malicious software designed for harm
3. C.A weakness or flaw in software that can be exploited to compromise security✓ Correct
4. D.A planned and well-documented software feature built for end users

Report an error in this question

Q2. What is the SDLC?

1. A.A high-level language used for development used in enterprise computing environments
2. B.A database management system for storing data records
3. C.A security tool for scanning and detecting vulnerabilities
4. D.A structured process for planning, creating, testing, and deploying software✓ Correct

Report an error in this question

Q3. Why is input validation important in secure coding?

1. A.To ensure user input is safe and prevent malicious data from being processed✓ Correct
2. B.To make the user interface look visually appealing
3. C.To speed up the application processing and response time
4. D.To reduce the overall file size of application resources

Report an error in this question

Q4. What is code review in secure development?

1. A.Copying code from the internet without attribution or proper licensing
2. B.Examining source code to identify security flaws, bugs, and code quality issues✓ Correct
3. C.Permanently deleting old obsolete source code from repository branches
4. D.Writing code faster without any verification of quality or correctness

Report an error in this question

Q5. What is secure software development?

1. A.Writing detailed technical documentation for all application code modules
2. B.Only testing for bugs and defects at the very end of the development cycle
3. C.Writing application code quickly without any formal quality review process
4. D.Integrating security measures throughout the entire software development lifecycle✓ Correct

Report an error in this question

Q6. What does 'security by design' mean?

1. A.Adding security measures only after production deployment
2. B.Building security into software from the earliest stages of development✓ Correct
3. C.Installing antivirus software on the development machine
4. D.Using only encryption as the single security measure

Report an error in this question

Q7. Why should default passwords be changed?

1. A.To comply with organizational branding requirements
2. B.To improve overall system performance and speed
3. C.To make the login process more difficult for users
4. D.Because default passwords are publicly known and easily exploited✓ Correct

Report an error in this question

Q8. What is the purpose of using HTTPS in web applications?

1. A.To block unwanted advertisements from displaying
2. B.To encrypt data transmitted between client and server✓ Correct
3. C.To compress web pages for reduced bandwidth usage
4. D.To optimize the website for faster loading performance

Report an error in this question

Q9. What is the purpose of error handling in secure coding?

1. A.To deliberately cause the application to crash on errors
2. B.To log all error details publicly for transparency
3. C.To ignore all errors and continue processing without alerts
4. D.To gracefully manage errors without exposing sensitive information✓ Correct

Report an error in this question

Q10. What is a security bug?

1. A.A physical hardware failure requiring component replacement
2. B.A network connectivity issue affecting system availability
3. C.A software defect that could be exploited to compromise system security✓ Correct
4. D.A planned feature request from the product stakeholders

Report an error in this question

Q11. What is threat modeling in software development?

1. A.Testing application performance under heavy load conditions
2. B.Creating threat actors for penetration testing exercises
3. C.Running antivirus scans on development machine environments
4. D.A structured approach to identifying and addressing security threats during design✓ Correct

Report an error in this question

Q12. What is the OWASP Secure Coding Practices guide?

1. A.A high-level language used for development within modern computing environments
2. B.A database design guide for managing enterprise data resources
3. C.A comprehensive checklist of secure coding practices organized by vulnerability category✓ Correct
4. D.A software application used for enterprise computing operations

Report an error in this question

Q13. What is the principle of fail-safe defaults?

1. A.Logging all defaults regardless of the specific situation or context
2. B.Ignoring security failures within enterprise security environments
3. C.Always granting access by default in security contexts
4. D.Denying access by default and requiring explicit permission grants✓ Correct

Report an error in this question

Q14. What is dynamic application security testing (DAST)?

1. A.Testing database query performance under heavy loads
2. B.Testing a running application by simulating attacks to find vulnerabilities✓ Correct
3. C.Testing source code without running it across computing environments
4. D.Testing code compilation for syntax errors and warnings

Report an error in this question

Q15. What is static application security testing (SAST)?

1. A.Testing network performance under heavy traffic loads
2. B.Testing user interfaces for usability and accessibility
3. C.Analyzing source code without executing it to find security vulnerabilities✓ Correct
4. D.Testing the application while it is actively running

Report an error in this question

Q16. What is dependency management in secure development?

1. A.Managing and coordinating team members across projects
2. B.Tracking, updating, and securing third-party libraries and components✓ Correct
3. C.Managing and configuring enterprise server infrastructure
4. D.Managing database servers and optimizing query performance

Report an error in this question

Q17. What is 'shift left' in security?

1. A.Integrating security practices earlier in the development lifecycle✓ Correct
2. B.Moving project deadlines earlier in the release timeline
3. C.Moving physical servers to the left of the data center
4. D.Changing code alignment and formatting in source files

Report an error in this question

Q18. What is the purpose of security testing in the SDLC?

1. A.To deliberately delay the project delivery timeline
2. B.To create comprehensive technical documentation materials
3. C.To identify and fix security vulnerabilities before deployment to production✓ Correct
4. D.To test and validate hardware components for compatibility

Report an error in this question

Q19. What is the concept of 'secure defaults'?

1. A.Having no security settings or controls enabled at all regardless of the deployment context or scenario
2. B.Using default vendor passwords for all system accounts across computing environments
3. C.Shipping applications with the most secure configuration, requiring users to explicitly reduce security✓ Correct
4. D.Applications require no configuration at all to operate regardless of the deployment context or scenario

Report an error in this question

Q20. What is the purpose of output encoding?

1. A.Making output look visually pretty and well-formatted
2. B.Compressing output data for reduced bandwidth consumption
3. C.Encrypting output using symmetric cipher key algorithms
4. D.Converting output to a safe format to prevent injection attacks like XSS✓ Correct

Report an error in this question

Q21. What is Interactive Application Security Testing (IAST)?

1. A.Manual code review conducted by human security reviewers
2. B.A software application used for enterprise computing operations
3. C.A hybrid combining SAST and DAST using instrumentation agents within the running application✓ Correct
4. D.A type of unit test for verifying individual code functions used in enterprise computing environments

Report an error in this question

Q22. What is a Software Bill of Materials (SBOM)?

1. A.A project plan for scheduling development milestones used in enterprise computing environments
2. B.A software application used for enterprise computing operations
3. C.A software license for managing application access rights
4. D.A comprehensive inventory of all components, libraries, and dependencies in software✓ Correct

Report an error in this question

Q23. What is secure session management?

1. A.Properly creating, maintaining, and destroying sessions to prevent hijacking and fixation✓ Correct
2. B.Sharing sessions between multiple users simultaneously
3. C.Deleting all cookies immediately after each page request
4. D.Never creating sessions for any user interactions at all regardless of the deployment context or scenario

Report an error in this question

Q24. What is the Microsoft Security Development Lifecycle (SDL)?

1. A.A Microsoft commercial product for endpoint security used in enterprise computing environments
2. B.A testing framework for automated unit testing of code used in enterprise computing environments
3. C.A high-level language used for development within modern computing environments
4. D.A process integrating security into every SDLC phase including training, design, and verification✓ Correct

Report an error in this question

Q25. What is the purpose of fuzz testing (fuzzing)?

1. A.Load testing application performance under heavy traffic
2. B.Providing random, unexpected, or malformed data as input to discover vulnerabilities✓ Correct
3. C.Testing user experience through usability research sessions
4. D.Testing application inputs with soft expected normal values

Report an error in this question

Q26. What is taint analysis in secure development?

1. A.Tracking untrusted data through an application to identify where it reaches sensitive operations unsanitized✓ Correct
2. B.A color analysis tool for evaluating interface themes used in enterprise computing environments
3. C.Source code formatting and style standardization practices across computing environments
4. D.A code obfuscation method for protecting intellectual property used in enterprise computing environments

Report an error in this question

Q27. What is Runtime Application Self-Protection (RASP)?

1. A.A programming pattern used in enterprise computing environments
2. B.Security technology built into an application that detects and prevents attacks in real-time✓ Correct
3. C.A self-replicating strain of malicious software targeting systems
4. D.A software application used for enterprise computing operations

Report an error in this question

Q28. What is a security champion program in DevSecOps?

1. A.Embedding security-trained developers within teams to advocate for security practices✓ Correct
2. B.A competitive security skills competition between teams used in enterprise computing environments
3. C.A hiring initiative for recruiting security professionals
4. D.A certification program for professional security credentials

Report an error in this question

Q29. What is DevSecOps?

1. A.Integrating security into DevOps pipelines through automation, making security a shared responsibility✓ Correct
2. B.A software application used for enterprise computing operations
3. C.A next-generation firewall security appliance deployed across enterprise environments
4. D.A high-level language used for development within modern computing environments

Report an error in this question

Q30. What is the purpose of a bug bounty program?

1. A.Paying developers to write application source code faster and more efficiently
2. B.Incentivizing external researchers to find and responsibly report vulnerabilities for rewards✓ Correct
3. C.An automated software testing service for quality assurance and code validation
4. D.A code quality improvement program focused on long-term maintainability goals

Report an error in this question