Secure Software Design (D487)
Access The Exact Questions for Secure Software Design (D487)
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock Actual Exam Questions and Answers for Secure Software Design (D487) on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Free Secure Software Design (D487) Questions
What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category
-
All administrative activities are logged and audited
-
Sensitive information is not logged
-
All exceptions are handled in a structured way
-
Inputs enforce type, format, length, and range checks
Explanation
Correct Answer:
d) Inputs enforce type, format, length, and range checks
Explanation:
The data validation/parameter validation threat category involves ensuring that inputs to a web application are properly validated to prevent malicious data from being processed. By enforcing type, format, length, and range checks on inputs, the application ensures that only valid data is accepted and reduces the risk of attacks such as SQL injection or buffer overflows.
Why other options are wrong:
a) All administrative activities are logged and audited: This is a good security practice for tracking and monitoring activities, but it is not directly related to data validation or parameter validation.
b) Sensitive information is not logged: While this is important for protecting sensitive data, it doesn't address the validation of user inputs.
c) All exceptions are handled in a structured way: Handling exceptions properly is important for application stability and security, but it is not specifically related to validating user inputs for correctness or security.
Which security assessment deliverable defines measures that will be periodically reported to management
-
Metrics template
-
Product risk profile
-
SDL project outline
-
Threat profile
Explanation
Correct Answer:
a) Metrics template
Explanation:
A metrics template defines the specific measures, key performance indicators (KPIs), and metrics that will be periodically reported to management. This deliverable ensures that the progress and effectiveness of security initiatives are tracked and communicated over time.
Why other options are wrong:
b) Product risk profile: This provides a snapshot of risks associated with a specific product, but it doesn't typically outline periodic reporting measures for management.
c) SDL project outline: This outlines the stages of the Secure Development Lifecycle (SDL), but it doesn't specifically define periodic measures for management.
d) Threat profile: This assesses and categorizes threats, but doesn't define reporting measures for management.
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying code that can cause unexpected behavior and application failure. Which security testing technique is being used
-
Binary fault injection
-
Fuzz testing
-
Dynamic code analysis
-
Source-code fault injection
Explanation
Correct Answer:
d) Source-code fault injection
Explanation:
Source-code fault injection involves modifying the source code to intentionally introduce errors or vulnerabilities, testing how the application responds to these faults. This method is done at the code level, which matches the scenario described where the team is modifying the source code repository to test for vulnerabilities and unexpected behavior.
Why other options are wrong:
a) Binary fault injection: This involves injecting faults at the binary level (compiled code), not the source code level.
b) Fuzz testing: While fuzz testing involves providing random or unexpected inputs to an application to detect vulnerabilities, it doesn’t involve modifying the source code directly.
c) Dynamic code analysis: This is typically a technique used to analyze code behavior during execution, usually to identify security issues or vulnerabilities in runtime, not by injecting faults at the source code level.
What is an advantage of using the Agile development methodology
-
Customer satisfaction is improved through rapid and continuous delivery of useful software.
-
Each stage is clearly defined, making it easier to assign clear roles to teams and departments who feed into the project.
-
The overall plan fits very neatly into a Gantt chart so a project manager can easily view the project timeline.
-
There is much less predictability throughout the project regarding deliverables.
Explanation
Correct Answer:
a) Customer satisfaction is improved through rapid and continuous delivery of useful software.
Explanation:
One of the key advantages of the Agile methodology is its focus on delivering small, incremental pieces of functional software quickly and consistently. This approach helps to meet customer needs more effectively and increases their satisfaction through continuous delivery of useful software.
Why other options are wrong:
b) Agile is iterative and flexible, and its stages are not rigidly defined. It focuses more on collaboration than clearly defined stages.
c) Agile does not fit neatly into traditional project management tools like Gantt charts. It focuses on flexibility and adaptability, rather than a fixed timeline.
d) While Agile embraces change, it does not imply a lack of predictability in deliverables. It aims for predictable, incremental delivery through sprints, making it more predictable than some other methods.
Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized
-
Error handling and logging
-
Authentication and password management
-
Input validation
-
System configuration
Explanation
Correct Answer:
a) Error handling and logging
Explanation:
Error handling and logging are crucial to ensure sensitive information is not exposed in error messages or logs. Developers should avoid displaying stack traces, database details, or other internal information in error messages shown to users. These details could potentially be exploited by attackers. Instead, generic error messages should be provided, and detailed information should be logged securely for internal purposes.
Why other options are wrong:
b) Authentication and password management: While critical for securing user identities, this practice primarily focuses on controlling access, not on preventing the disclosure of sensitive information in responses.
c) Input validation: Input validation helps to prevent injection attacks and other malicious inputs, but it doesn’t specifically address the risk of disclosing sensitive information in error messages.
d) System configuration: Proper configuration of the system (e.g., disabling directory listing) is important for security, but it doesn't directly prevent sensitive information from being disclosed in responses to users.
The software security team is performing security testing on a new software product using a testing tool that scans the running application for known exploits. Which security testing technique is being used
-
Automated vulnerability scanning
-
Property-based testing
-
Source-code analysis
-
Penetration testing
Explanation
Correct Answer:
a) Automated vulnerability scanning
Explanation:
Automated vulnerability scanning involves using a tool to scan an application for known vulnerabilities and exploits. It checks the running application for common vulnerabilities, typically based on a database of known exploits. This process is automated and helps identify security weaknesses.
Why other options are wrong:
b) Property-based testing: This is a technique used to test certain properties of the system (like security properties), but it does not specifically scan for known exploits.
c) Source-code analysis: This involves reviewing the actual source code for security flaws but does not scan the running application or check for known exploits in the same way automated vulnerability scanning does.
d) Penetration testing: This is a manual, simulated attack on the application, performed by security professionals to find vulnerabilities. It is more hands-on compared to automated scanning tools.
Developers have finished coding, and changes have been peer reviewed. Features have been deployed to a pre-production environment so that analysts may verify that the product is working as expected. Which phase of the software development Life Cycle (SDLC) is being described
-
Testing
-
Requirements
-
Deployment
-
Design
Explanation
Correct Answer:
a) Testing
Explanation:
In the Testing phase, the product is deployed to a pre-production or testing environment where analysts and quality assurance teams verify that the features are working as expected, ensuring the product meets the specified requirements.
Why other options are wrong:
b) Requirements: The requirements phase is about gathering and defining the needs for the system, not about testing functionality.
c) Deployment: Deployment refers to the final release of the software to the production environment, which occurs after testing.
d) Design: The design phase involves creating the system architecture and design plans before any coding or testing happens.
Which DREAD category is based on how easily a threat exploit can be found
-
Damage potential
-
Discoverability
-
Affected users
-
Reproducibility
Explanation
Correct Answer:
b) Discoverability
Explanation:
Discoverability refers to how easily a threat exploit can be identified or found by an attacker. This DREAD category evaluates the likelihood of an attacker discovering a vulnerability or weakness in a system that could be exploited.
Why other options are wrong:
a) Damage potential: This category refers to the potential impact or harm caused by a successful exploit, not the ease of discovering the exploit.
c) Affected users: This category assesses how many users would be impacted if the threat were to occur, not how easily the exploit can be discovered.
d) Reproducibility: This category measures how easily the exploit can be repeated or reproduced by an attacker once discovered, but not the ease with which it can be discovered initially.
Which threat modeling step assigns a score to discovered threats
-
Analyze the target
-
Set the scope
-
Rate threats
-
Identify and document threats
Explanation
Correct Answer:
c) Rate threats
Explanation:
The Rate threats step involves assigning scores or severity levels to the identified threats based on factors such as impact, likelihood, and exploitability. This helps prioritize threats that need more attention and mitigation efforts.
Why other options are wrong:
a) Analyze the target: This step involves understanding the system or application being analyzed and its components but doesn't directly involve scoring the threats.
b) Set the scope: This step defines the boundaries of the threat modeling exercise, determining which parts of the system or application will be analyzed but doesn't involve scoring threats.
d) Identify and document threats: This step focuses on discovering and documenting potential threats but does not involve assigning scores to them.
A product team, consisting of a scrum master, a business analyst, two developers, and a quality assurance tester are on a video call with the product owner. The team is reviewing a list to determine how many they feel can be added to their backlog and completed within the next two week iteration. Which scrum ceremony is the team participating in
-
Sprint planning
-
Daily scrum
-
Sprint review
-
Sprint retrospective
Explanation
Correct Answer:
a) Sprint planning
Explanation:
In Sprint Planning, the scrum team collaborates to review the backlog and decide which items will be included in the upcoming sprint. The goal is to determine how much work the team can complete in the next iteration (typically two weeks).
Why other options are wrong:
b) Daily scrum: The Daily Scrum (also known as the Daily Standup) is a brief meeting held every day during the sprint to discuss progress, impediments, and plans for the next 24 hours.
c) Sprint review: The Sprint Review is a meeting held at the end of the sprint to demonstrate the completed work and discuss whether the sprint goals were met, not to plan the next sprint.
d) Sprint retrospective: The Sprint Retrospective takes place after the Sprint Review and focuses on reflecting on the sprint's process and identifying areas for improvement for the next sprint.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
The course focuses on secure coding principles, software vulnerabilities, authentication mechanisms, cryptography, and best practices for designing secure applications.
Secure software design helps prevent cyber threats such as SQL Injection, Cross-Site Scripting (XSS), authentication bypasses, and data breaches, ensuring application security and compliance with industry standards.
The course covers vulnerabilities like SQL Injection, XSS, Cross-Site Request Forgery (CSRF), insecure authentication, weak cryptography, and improper error handling.
Using prepared statements and parameterized queries is the most effective method to prevent SQL Injection, as it ensures user input is treated strictly as data, not executable code.
XSS occurs when an attacker injects malicious scripts into web pages viewed by users. It can be prevented by sanitizing and encoding user input, using a Content Security Policy (CSP), and avoiding innerHTML in JavaScript.
MFA requires users to verify their identity using multiple factors (e.g., password + one-time code). It significantly enhances security by preventing unauthorized access, even if a password is compromised.
Authentication verifies a user’s identity (e.g., username and password). Authorization determines what actions or data a user is allowed to access after authentication.