Exact2Pass
Features have been developed and fully tested, the production environment has been created, and leadership has approved the release of the new product. Technicians have scheduled a time and date to make the product available to customers.
Which phase of the software development lifecycle (SDLC) is being described?
A potential threat was discovered during vulnerability testing when an environment configuration file was found that contained the database username and password stored in plain text.
How should existing security controls be adjusted to prevent this in the future?
Credit card numbers are encrypted when stored in the database but are automatically decrypted when data is fetched. The testing tool intercepted the GET response, and testers were able to view credit card numbers as clear text.
How should the organization remediate this vulnerability?
The security team contracts with an independent security consulting firm to simulate attacks on deployed products and report results to organizational leadership.
Which category of secure software best practices is the team performing?
Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized?
Which question reflects the security change management component of the change management process?
The software security team prepared a detailed schedule napping security development lifecycle phases to the type of analysis they will execute.
Which design and development deliverable aid the team prepare?
Which SDL security goal is defined as ensuring timely and reliable access to and use of information?
The security team is reviewing whether changes or open issues exist that would affect requirements for handling personal information documented in earlier phases of the development life cycle.
Which activity of the Ship SDL phase is being performed?
Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized?
Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?
Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?
What are the three primary goals of the secure software development process?
The security team is identifying technical resources that will be needed to perform the final product security review.
Which step of the final product security review process are they in?
The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?
Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component. The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal and environmental metrics.
Which rating would CVSS assign this vulnerability?
Which category classifies identified threats that have some defenses in place and expose the application to limited exploits?
Which security assessment deliverable defines measures that can be periodically reported to management?
The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies.
Which post-release deliverable is being described?
The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations.
Which activity of the Ship SDL phase is being performed?
The software security team prepared a report of necessary coding and architecture changes identified during the security assessment.
Which design and development deliverable did the team prepare?
Company leadership has discovered an untapped revenue stream within its customer base and wants to meet with IT to share its vision for the future and determine whether to move forward.
Which phase of the software development lifecycle (SDLC) is being described?
Company leadership has contracted with a security firm to evaluate the vulnerability of all externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
Which security assessment deliverable identities unmanaged code that must be kept up to date throughout the life of the product?
Which threat modeling methodology involves creating or using collections of similar threats?
What sits between a browser and an internet connection and alters requests and responses in a way the developer did not intend?
Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?
Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?
Security testers have completed testing and are documenting the results of vulnerability scans and penetration analysis They are also creating documentation lo share with the organization's largest customers.
Which deliverable is being prepared?