Secure Software Design (D487)
Access The Exact Questions for Secure Software Design (D487)
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock 36 + Actual Exam Questions and Answers for Secure Software Design (D487) on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Need Practice Questions for Secure Software Design (D487) ? Try studying with 150 + questions shared by our website
Free Secure Software Design (D487) Questions
A security architect is creating a data flow diagram and draws an arrow between two circles. What does the arrow represent
-
External entity
-
Process
-
Data flow
-
Data store
Explanation
Correct Answer:
c) Data flow
Explanation:
In a data flow diagram (DFD), an arrow represents the flow of data between processes, data stores, or external entities. The arrow shows how data moves or is transmitted from one part of the system to another. In this case, the two circles typically represent processes, and the arrow indicates the direction of data flow between them.
Why other options are wrong:
a) External entity: External entities are usually represented as rectangles or squares in a DFD, not by arrows.
b) Process: A process is typically represented by a circle or oval, but the arrow itself indicates data movement rather than the process itself.
d) Data store: Data stores are usually represented as open-ended rectangles or parallel lines in a DFD, not by arrows.
A product team, consisting of a scrum master, a business analyst, two developers, and a quality assurance tester are on a video call with the product owner. The team is reviewing a list to determine how many they feel can be added to their backlog and completed within the next two week iteration. Which scrum ceremony is the team participating in
-
Sprint planning
-
Daily scrum
-
Sprint review
-
Sprint retrospective
Explanation
Correct Answer:
a) Sprint planning
Explanation:
In Sprint Planning, the scrum team collaborates to review the backlog and decide which items will be included in the upcoming sprint. The goal is to determine how much work the team can complete in the next iteration (typically two weeks).
Why other options are wrong:
b) Daily scrum: The Daily Scrum (also known as the Daily Standup) is a brief meeting held every day during the sprint to discuss progress, impediments, and plans for the next 24 hours.
c) Sprint review: The Sprint Review is a meeting held at the end of the sprint to demonstrate the completed work and discuss whether the sprint goals were met, not to plan the next sprint.
d) Sprint retrospective: The Sprint Retrospective takes place after the Sprint Review and focuses on reflecting on the sprint's process and identifying areas for improvement for the next sprint.
Which category classifies identified threats that have defenses in place and do not expose the application to exploits
-
Partially mitigated threat
-
Threat profile
-
Fully mitigated threat
-
Unmitigated threats
Explanation
Correct Answer:
c) Fully mitigated threat
Explanation:
A fully mitigated threat is one where defenses are in place to prevent the exploitation of vulnerabilities, ensuring the application is protected against identified threats.
Why other options are wrong:
a) Partially mitigated threat: This refers to threats where some defenses are in place, but not all vulnerabilities have been addressed, leaving room for exploitation.
b) Threat profile: This refers to the overall categorization or assessment of the potential threats but does not specifically indicate the level of defense or mitigation.
d) Unmitigated threats: These are threats without any defenses or mitigations in place, meaning the application is exposed to potential exploits.
Company leadership has discovered an untapped revenue stream within its customer base and wants to meet with IT to share its vision for the future and determine whether to move forward. Which phase of the software development Life Cycle (SDLC) is being described
-
Implementation
-
Design
-
Requirements
-
Planning
Explanation
Correct Answer:
d) Planning
Explanation:
In the Planning phase of the SDLC, the company discusses its goals, vision, and the overall feasibility of a project. Leadership determines whether the idea should be pursued further and shares it with IT to decide how to move forward.
Why other options are wrong:
a) Implementation: This phase focuses on actually developing and deploying the system, which happens after planning and requirements are defined.
b) Design: The design phase involves creating a blueprint or architectural plan for the system, which comes after the planning and requirements phases.
c) Requirements: The requirements phase focuses on gathering detailed specifications for the system, but the high-level vision shared with IT in this scenario aligns more with planning.
What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings for the user
-
P1 high privacy risk
-
P2 moderate privacy risk
-
P3 low privacy risk
-
P4 no privacy risk
Explanation
Correct Answer:
a) P1 high privacy risk
Explanation:
The application stores personally identifiable information (PII), which is inherently high-risk in terms of privacy. Additionally, ongoing transfers of data (even if anonymized) and the ability to change user settings further increase the potential for misuse or exposure of sensitive data. Therefore, this application is categorized with a high privacy risk.
Why other options are wrong:
b) P2 moderate privacy risk: While the app does deal with PII and has ongoing data transfers, the presence of settings changes makes it a higher risk than moderate.
c) P3 low privacy risk: Storing PII and monitoring users increases privacy risks beyond what would be classified as low.
d) P4 no privacy risk: Storing PII and transferring data, even anonymously, involves significant privacy risks, so it cannot be classified as having no privacy risk.
Which security assessment deliverable defines measures that will be periodically reported to management
-
Metrics template
-
Product risk profile
-
SDL project outline
-
Threat profile
Explanation
Correct Answer:
a) Metrics template
Explanation:
A metrics template defines the specific measures, key performance indicators (KPIs), and metrics that will be periodically reported to management. This deliverable ensures that the progress and effectiveness of security initiatives are tracked and communicated over time.
Why other options are wrong:
b) Product risk profile: This provides a snapshot of risks associated with a specific product, but it doesn't typically outline periodic reporting measures for management.
c) SDL project outline: This outlines the stages of the Secure Development Lifecycle (SDL), but it doesn't specifically define periodic measures for management.
d) Threat profile: This assesses and categorizes threats, but doesn't define reporting measures for management.
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying code that can cause unexpected behavior and application failure. Which security testing technique is being used
-
Binary fault injection
-
Fuzz testing
-
Dynamic code analysis
-
Source-code fault injection
Explanation
Correct Answer:
d) Source-code fault injection
Explanation:
Source-code fault injection involves modifying the source code to intentionally introduce errors or vulnerabilities, testing how the application responds to these faults. This method is done at the code level, which matches the scenario described where the team is modifying the source code repository to test for vulnerabilities and unexpected behavior.
Why other options are wrong:
a) Binary fault injection: This involves injecting faults at the binary level (compiled code), not the source code level.
b) Fuzz testing: While fuzz testing involves providing random or unexpected inputs to an application to detect vulnerabilities, it doesn’t involve modifying the source code directly.
c) Dynamic code analysis: This is typically a technique used to analyze code behavior during execution, usually to identify security issues or vulnerabilities in runtime, not by injecting faults at the source code level.
The product security incident response team (PSIRT) has decided to make a formal public disclosure, including base and temporal common vulnerability common vulnerabilities and exposures (CVE) ID report, of an externally discovered vulnerability. What is the most likely reason for making a public disclosure
-
The potential for increased public awareness of a vulnerability is probable, which could lead to higher risk for customers.
-
The response team has determined that the vulnerability is credible.
-
The vulnerability reporter has threatened to make the finding public after being notified that their case was not credible.
-
Notification of a vulnerability from an external party has occurred
Explanation
Correct Answer:
b) The response team has determined that the vulnerability is credible.
Explanation:
A public disclosure of a vulnerability is typically made when the response team has determined the vulnerability is credible and requires attention. Disclosure is intended to inform the public, users, and affected parties so that mitigation strategies can be implemented.
Why other options are wrong:
a) The potential for increased public awareness of a vulnerability is probable, which could lead to higher risk for customers: While public disclosure could increase awareness and risk, it is primarily about transparency and responsible sharing of the vulnerability to allow for mitigation.
c) The vulnerability reporter has threatened to make the finding public after being notified that their case was not credible: This response does not align with responsible disclosure processes. Disclosure would occur after verification of the vulnerability, not due to a threat.
d) Notification of a vulnerability from an external party has occurred: This is part of the process of identifying a vulnerability, but it does not justify public disclosure by itself. The team needs to verify and assess the vulnerability before disclosing.
Which architecture deliverable identifies the organization's tolerance to security issues and how the organization plans to react if a security issue occurs
-
Policy compliance analysis
-
Threat modeling artifacts
-
Business requirements
-
Risk mitigation plan
Explanation
Correct Answer:
d) Risk mitigation plan
Explanation:
A risk mitigation plan identifies the organization's tolerance for security issues and outlines how the organization will respond in the event of a security incident. This includes the strategies for reducing, transferring, or accepting risk, as well as incident response procedures.
Why other options are wrong:
a) Policy compliance analysis: This evaluates the adherence to security policies but doesn't focus on the organization's tolerance or response to security issues.
b) Threat modeling artifacts: These identify potential threats to the system, but they do not outline how the organization will react to those threats.
c) Business requirements: These outline the necessary features and functions of the system but do not address security risk tolerance or response strategies.
Which mitigation technique is used to fight against an identity spoofing threat
-
Audit trails
-
Require user authorization
-
Filtering
-
Encryption
Explanation
Correct Answer:
b) Require user authorization
Explanation:
Requiring user authorization is a key mitigation technique to prevent identity spoofing. By enforcing authentication mechanisms (e.g., multi-factor authentication, password verification), systems can verify the identity of the user, ensuring that the actions or requests are coming from the rightful individual, thus reducing the risk of identity spoofing.
Why other options are wrong:
a) Audit trails: Audit trails help track and log actions within a system, but they do not directly prevent identity spoofing. They are useful for detecting suspicious activities after the fact, but they don't mitigate the risk in real-time.
c) Filtering: While filtering can block certain malicious traffic or behavior, it is not specifically focused on preventing identity spoofing, which relies on verifying a user's identity.
d) Encryption: Encryption secures data in transit or at rest, but it does not directly address the problem of spoofed identities. Encryption helps protect the confidentiality and integrity of the data but does not authenticate the identity of the user.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
The course focuses on secure coding principles, software vulnerabilities, authentication mechanisms, cryptography, and best practices for designing secure applications.
Secure software design helps prevent cyber threats such as SQL Injection, Cross-Site Scripting (XSS), authentication bypasses, and data breaches, ensuring application security and compliance with industry standards.
The course covers vulnerabilities like SQL Injection, XSS, Cross-Site Request Forgery (CSRF), insecure authentication, weak cryptography, and improper error handling.
Using prepared statements and parameterized queries is the most effective method to prevent SQL Injection, as it ensures user input is treated strictly as data, not executable code.
XSS occurs when an attacker injects malicious scripts into web pages viewed by users. It can be prevented by sanitizing and encoding user input, using a Content Security Policy (CSP), and avoiding innerHTML in JavaScript.
MFA requires users to verify their identity using multiple factors (e.g., password + one-time code). It significantly enhances security by preventing unauthorized access, even if a password is compromised.
Authentication verifies a user’s identity (e.g., username and password). Authorization determines what actions or data a user is allowed to access after authentication.