Provide WGU Secure-Software-Design Practice Test Engine for Preparation
Detailed New Secure-Software-Design Exam Questions for Concept Clearance
NEW QUESTION # 52
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?
- A. Session management
- B. Data protection
- C. Access control
- D. Communication security
Answer: C
Explanation:
The secure coding best practice that recommends using a single application-level authorization component to lock down the application if it cannot access its configuration information is known as Access Control. This practice is part of a broader set of security measures aimed at ensuring that only authorized users have access to certain functionalities or data within an application. By centralizing the authorization logic, it becomes easier to manage and enforce security policies consistently across the application. If the authorization component cannot retrieve its configuration, it defaults to a secure state, thus preventing unauthorized access1.
References: 1: OWASP Secure Coding Practices - Quick Reference Guide
NEW QUESTION # 53
The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?
- A. Policy compliance analysis
- B. Open-source licensing review
- C. Final security review
- D. Penetration testing
Answer: B
Explanation:
The activity described pertains to the review of noncommercial software libraries to ensure compliance with the legal specifications set by the authors. This is part of the open-source licensing review, which is a critical activity in the Ship phase of the Security Development Lifecycle (SDL). This review ensures that all open-source components are used in accordance with their licenses, which is essential for legal and security compliance.
References: The Ship phase of the SDL includes various activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensingreview, and final security and privacy reviews12. The open-source licensing review specifically addresses the legal aspects of using third-party software components2.
NEW QUESTION # 54
Company leadership has discovered an untapped revenue stream within its customer base and wants to meet with IT to share its vision for the future and determine whether to move forward.
Which phase of the software development lifecycle (SDLC) is being described?
- A. Requirements
- B. Planning
- C. Design
- D. Implementation
Answer: B
Explanation:
The phase being described is the Planning phase of the SDLC. This initial stage involves gathering business requirements and evaluating the feasibility of the project. It's when the company leadership would typically meet with IT and other stakeholders to share visions for the future, discuss potential revenue streams, and determine the project'sdirection before moving forward with development. This phase is crucial for setting the groundwork for all subsequent phases of the SDLC.
References:
* The Software Development Life Cycle (SDLC): 7 Phases and 5 Models1.
* What Is the Software Development Life Cycle? SDLC Explained2.
* Software Development Life Cycle (SDLC) Phases & Models3.
NEW QUESTION # 55
A company is moving forward with a new product. Product scope has been determined, teams have formed, and backlogs have been created. Developers areactively writing code for the new product, with one team concentrating on delivering data via REST services, one Team working on the mobile apps, and a third team writing the web application.
Which phase of the software developmentlifecycle(SDLC) is being described?
- A. Requirements
- B. Design
- C. Deployment
- D. Implementation
Answer: D
Explanation:
The phase being described is the Implementation phase of the SDLC. During this phase, the actual development starts, and the product begins to be built. The teams are actively writing code, which is a key activity of the Implementation phase. This phase involves translating the design and specifications into executable code, developing the software's features, and then integrating the various components into a full-fledged system.
References:
* The Software Development Life Cycle (SDLC): 7 Phases and 5 Models1.
* What Is the Software Development Life Cycle? SDLC Explained2.
* SDLC: 6 Main Stages of the Software Product Development Lifecycle3.
* Software Development Life Cycle (SDLC) Phases & Models4.
NEW QUESTION # 56
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Spoofing
- B. Information disclosure
- C. Elevation of privilege
- D. Tampering
Answer: D
NEW QUESTION # 57
A potential threat was discovered during vulnerability testing when an environment configuration file was found that contained the database username and password stored in plain text.
How should existing security controls be adjusted to prevent this in the future?
- A. Enforce Role-Based Authorization
- B. Validate All User Input
- C. Ensure Strong Password Policies are in Effect
- D. Encrypt Secrets in Storage and Transit
Answer: D
NEW QUESTION # 58
What is a countermeasure to the web application security frame (ASF) authentication threat category?
- A. Sensitive information is scrubbed from error messages
- B. Role-based access controls restrict access
- C. Credentials and tokens are encrypted.
- D. Cookies have expiration timestamps.
Answer: B
Explanation:
* ASF Authentication Threats: The Web Application Security Frame (ASF) authentication category encompasses threats related to how users and systems prove their identity to the application. This includes issues like weak passwords, compromised credentials, and inadequate access controls.
* Role-Based Access Control (RBAC): RBAC is a well-established security principle that aligns closely with addressing authentication threats. It involves assigning users to roles and granting those roles specific permissions based on the principle of least privilege. This limits the attack surface and reduces the impact of a compromised user account.
Let's analyze the other options:
* B. Credentials and tokens are encrypted: While vital for security, encryption primarily protects data at rest or in transit. It doesn't directly address authentication risks like brute-force attacks or weak password management.
* C. Cookies have expiration timestamps: Expiring cookies are a good practice, but their primary benefit is session management rather than directly mitigating authentication-specific threats.
* D. Sensitive information is scrubbed from error messages: While essential for preventing information leakage, this practice doesn't address the core threats within the ASF authentication category.
References:
* NIST Special Publication 800-53 Revision 4, Access Control (AC) Family: (https://csrc.nist.gov
/publications/detail/sp/800-53/rev-4/final) Details the importance of RBAC as a cornerstone of access control.
* The Web Application Security Frame (ASF): (https://patents.google.com/patent/US7818788B2/en) Outlines the ASF categories, with authentication being one of the primary areas.
NEW QUESTION # 59
Which threat modeling step collects exploitable weaknesses within the product?
- A. Set the scope
- B. Analyze the target
- C. Rate threats
- D. Identify and document threats
Answer: D
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 60
What are the three primary goals of the secure software development process?
- A. Cost, speed to market, and profitability
- B. Confidentiality, integrity, and availability
- C. Performance, reliability, and maintainability
- D. Redundancy, scalability, and portability
Answer: B
Explanation:
The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).
* Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
* Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
* Availability ensures that information and resources are accessible to authorized users when needed.
This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.
References: The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3.
NEW QUESTION # 61
After being notified of a vulnerability in the company's online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab.
What is the response team's next step?
- A. Identify Resources and Schedule the Fix
- B. Determine How the Reporter Was Able to Create the Vulnerability
- C. Notify the Reporter That the Case Is Going to Be Closed
- D. Determine the Severity of the Vulnerability
Answer: B
NEW QUESTION # 62
What are the three primary goals of the secure software development process?
- A. Cost, speed to market, and profitability
- B. Confidentiality, integrity, and availability
- C. Performance, reliability, and maintainability
- D. Redundancy, scalability, and portability
Answer: B
Explanation:
The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).
* Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
* Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
* Availability ensures that information and resources are accessible to authorized users when needed. This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.
References: The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3.
NEW QUESTION # 63
Which design and development deliverable contains the types of evaluations that were performed, how many times they were performed, and how many times they were re-evaluated?
- A. Remediation report
- B. Privacy compliance report
- C. Security test execution report
- D. Security testing reports
Answer: D
Explanation:
Security testing reports are the most likely deliverables to contain detailed records of evaluations, their frequency, and re-evaluations. Here's why:
* Purpose of Security Testing Reports: These reports document the results of security testing, including:
* Types of tests: Vulnerability scans, penetration tests, code reviews, etc.
* Frequency: How often tests were conducted (e.g., per build, per release cycle).
* Re-evaluations: If vulnerabilities were discovered, these reports will track whether and how often those were retested after remediation.
* Focus on Testing: The question specifically emphasizes evaluations, which aligns with the core content of security testing reports.
NEW QUESTION # 64
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?
- A. Session management
- B. Data protection
- C. Access control
- D. Communication security
Answer: C
NEW QUESTION # 65
What are the eight phases of the software development lifecycle (SDLC)?
- A. Plan, gather requirements, identify attack surface, design, write code, perform code reviews, test, deploy
- B. Gather requirements, prototype, perform threat modeling, write code, test, user acceptance testing, deploy, maintain
- C. Planning, security analysis, requirement analysis, design, implementation, threat mitigation, testing, maintenance
- D. Planning, requirements, design, implementation, testing, deployment, maintenance, end of life
Answer: D
NEW QUESTION # 66
Which mitigation technique is used to fight against an identity spoofing threat?
- A. Filtering
- B. Audit trails
- C. Encryption
- D. Require user authorization
Answer: D
Explanation:
To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization.
This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for attackers to spoof an identity successfully.
References:
* Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.
* The National Security Agency's guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures2.
* Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks3.
* The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud4.
NEW QUESTION # 67
The security team is identifying technical resources that will be needed to perform the final product security review.
Which step of the final product security review process are they in?
- A. Identify Feature Eligibility
- B. Evaluate and Plan for Remediation
- C. Assess Resource Availability
- D. Release and Ship
Answer: C
NEW QUESTION # 68
Which security assessment deliverable identities possible security vulnerabilities in the product?
- A. Threat profile
- B. Metrics template
- C. SDL project outline
- D. List of third-party software
Answer: A
Explanation:
A threat profile is a security assessment deliverable that identifies possible security vulnerabilities in a product. It involves a systematic examination of the product to uncover any weaknesses that could potentially be exploited by threats. The process typically includes identifying the assets that need protection, assessing the threats to those assets, and evaluating the vulnerabilities that could be exploited by those threats. This deliverable is crucial for understanding the security posture of a product and for prioritizing remediation efforts.
References: The importance of a threat profile in identifying security vulnerabilities is supported by various security resources. For instance, Future Processing's blog on vulnerability assessments outlines the steps involved in identifying security vulnerabilities, which align with the creation of a threat profile1. Additionally, UpGuard's article on conducting vulnerability assessments further emphasizes the role of identifying vulnerabilities as part of the security assessment process2.
NEW QUESTION # 69
Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?
- A. Dynamic
- B. Static
- C. Black box
- D. White box
Answer: C
Explanation:
The software control test that examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output is known as black box testing. This testing method focuses on the functionality of the application rather than its internal structures or workings. Testers provide inputs and examine outputs without knowing how and where the inputs are worked upon. It's designed to test the system's external behavior.
* Black box testing is used to verify that the system meets the requirements and behaves as expected in various scenarios, including edge cases and incorrect input data. It helps in identifying discrepancies between the system's actual functionality and its specified requirements.
* This type of testing is applicable across various levels of software testing, including unit, integration,
* system, and acceptance testing. It is particularly useful for validating user stories and use cases during the software development process.
* Since black box testing treats the software as a "black box", it does not require the tester to have knowledge of the programming languages or the system's implementation. This allows testers to objectively test the software's behavior and performance.
References: The concept of black box testing is well-documented and is a standard practice in secure software design, as outlined by sources such as LambdaTest1 and other industry best practices.
NEW QUESTION # 70
The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP OpenSAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?
- A. Construction
- B. Verification
- C. Deployment
- D. Governance
Answer: B
Explanation:
The OpenSAMM business function being assessed is Verification. This function involves activities related to reviewing and testing to ensure that the software meets the required security standards and practices. In the context of the question, the software security group's focus on reviewing design artifacts to ensure compliance with organizational security standards falls under the Verification function. This includes tasks such as design review, implementation review, and security testing, which are all aimed at verifying that the security measures and controls are correctly integrated into the software design.
References: The information is verified as per the OWASP SAMM documentation, which outlines the Verification function as a core business function that encompasses activities like design review, which is directly related to the assessment of design artifacts mentioned in the question1.
NEW QUESTION # 71
Using a web-based common vulnerabilityscoringsystem (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component.The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal andenvironmental metrics.
Which rating would CVSS assign this vulnerability?
- A. High severity
- B. Medium severity
- C. Low severity
- D. Critical severity
Answer: A
Explanation:
The Common Vulnerability Scoring System (CVSS) uses the following ranges to determine the severity rating of a vulnerability:
* 0.1 - 3.9: Low severity
* 4.0 - 6.9: Medium severity
* 7.0 - 8.9: High severity
* 9.0 - 10.0: Critical severity
Since the adjusted score for the vulnerability is 5.9, it falls within theHigh severityrange.
References:
* CVSS v3.1 Specification Document - FIRST: https://www.first.org/cvss/specification-document
* National Vulnerability Database (NVD) - NIST: https://nvd.nist.gov/vuln-metrics/cvss
NEW QUESTION # 72
Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?
- A. Data Protection
- B. Input Validation
- C. Session Management
- D. Memory Management
Answer: D
NEW QUESTION # 73
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?
- A. Static analysis
- B. Manual code review
- C. Dynamic analysis
- D. Fuzz testing
Answer: C
Explanation:
Dynamic analysis is a security testing method that involves analyzing the behavior of software while it is running or in execution. It is most commonly executed during the testing phase of the Software Development Life Cycle (SDLC). This type of analysis is used to detect issues that might not be visible in the code's static state, such as runtime errors and memory leaks. Automated tools are employed to perform dynamic analysis, which can simulate attacks on the application and identify vulnerabilities that could be exploited by malicious actors.
References: The information provided here is verified by multiple sources that discuss security automation in the SDLC and the role of dynamic analysis during the testing phase123.
NEW QUESTION # 74
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure.
Which security testing technique is being used?
- A. Dynamic Code Analysis
- B. Source-Code Fault Injection
- C. Fuzz Testing
- D. Binary Fault Injection
Answer: B
NEW QUESTION # 75
......
Secure-Software-Design 2025 Training With 106 QA's: https://www.prep4sures.top/Secure-Software-Design-exam-dumps-torrent.html
Secure-Software-Design Exam Preparation Material with New Secure-Software-Design Dumps Questions.: https://drive.google.com/open?id=1yZAVDR4meA7QokNR25cI6mcEyodFdnQN