Exam for engine

QUESTION 10
After being notified of a vulnerability in the company’s online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab.
What is the response team’s next step?

QUESTION 11
While performing functional testing of the new product from a shared machine, a QA analyst closed their browser window but did not logout of the application. A different QA analyst accessed the application an hour later and was not prompted to login. They then noticed the previous analyst was still logged into the application.
How should existing security controls be adjusted to prevent this in the future?

QUESTION 12
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?

QUESTION 13
The security team is reviewing whether changes or open issues exist that would affect requirements for handling personal information documented in earlier phases of the development life cycle.
Which activity of the Ship SDL phase is being performed?

QUESTION 14
Which design and development deliverable contains the results of each type of evaluation that was performed and the type and number of vulnerabilities discovered?

QUESTION 15
Which mitigation technique is used to fight against an identity spoofing threat?

QUESTION 16
The software security team prepared a detailed schedule napping security development lifecycle phases to the type of analysis they will execute.
Which design and development deliverable aid the team prepare?

QUESTION 17
Which security assessment deliverable identities unmanaged code that must be kept up to date throughout the life of the product?

QUESTION 18
In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?

QUESTION 19
The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one- time requirements, bucket requirements, and final security review requirements.
Which type of requirement slates that the team must identify primary security and privacy contacts?

QUESTION 20
Which type of security analysis is performed by reviewing source code line-by-line after other security analysis techniques have been executed?

QUESTION 21
The security team has a library of recorded presentations that are required viewing tor all new developers in the organization. The video series details organizational security policies and demonstrates how to define, test for. and code tor possible threats.
Which category of secure software best practices does this represent?

QUESTION 22
The software security team prepared a report of necessary coding and architecture changes identified during the security assessment.
Which design and development deliverable did the team prepare?

QUESTION 23
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?

QUESTION 24
Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?

QUESTION 25
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?

QUESTION 26
In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?

QUESTION 27
The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations.
Which activity of the Ship SDL phase is being performed?

QUESTION 28
Which security assessment deliverable identifies possible security vulnerabilities in the product?

QUESTION 29
The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team’s quality standards.
Which category of secure software best practices is the team performing?

QUESTION 30
The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.
Which security testing technique is being used?

QUESTION 31
Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only those needed for the business purpose?

QUESTION 32
Which secure coding best practice says to assume all incoming data should be considered untrusted and should be validated to ensure the system only accepts valid data?

QUESTION 33
Which threat modeling step collects exploitable weaknesses within the product?

QUESTION 34
What are the three primary goals of the secure software development process?