Secure Software Design (D487)
Access The Exact Questions for Secure Software Design (D487)
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock Actual Exam Questions and Answers for Secure Software Design (D487) on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Free Secure Software Design (D487) Questions
While performing functional testing of the new product from a shared machine, a QA analyst closed their browser window but did not log out of the application. A different QA analyst accessed the application an hour later and was not prompted to log in. They then noticed the previous analyst was still logged into the application. How should existing security controls be adjusted to prevent this in the future?
- Ensure no sensitive information is stored in plain text in cookies
- Ensure user sessions timeout after short intervals
- Ensure strong password policies are enforced
- Ensure role-based access control is enforced for access to all resources
Explanation
Explanation:
Correct answer: Ensure user sessions timeout after short intervals
The issue described is a session management problem where closing the browser does not terminate the authenticated session, allowing another user on the same machine to continue using the previous session. The correct mitigation is to implement short session timeouts, which automatically end inactive or abandoned sessions after a defined period. This prevents unauthorized access when a user forgets to log out. The other options do not address the root cause: cookie encryption protects stored data but not session persistence, password policies relate to authentication strength, and role-based access control governs permissions after login but does not prevent session reuse.
A potential threat was discovered during automated system testing when a PATCH request sent to the API caused an unhandled server exception. The API only supports GET, POST, PUT, and DELETE requests. How should existing security controls be adjusted to prevent this in the future?
- Properly configure acceptable API requests
- Ensure audit logs are in place for sensitive transactions
- Use API keys to enforce authorization of every request
- Enforce role-based authorization
Explanation
Explanation:
Correct answer: Properly configure acceptable API requests
The issue occurs because the API is not properly handling unsupported HTTP methods (PATCH), resulting in an unhandled exception. This is a form of input validation at the protocol/request level. The correct control is to properly configure acceptable API requests, meaning the system should explicitly define and enforce allowed HTTP methods and reject unsupported ones gracefully (e.g., returning a controlled 405 Method Not Allowed response). The other options are unrelated to preventing this type of request-handling vulnerability: audit logs help monitoring, API keys manage authentication, and role-based access control manages permissions after authentication.
What is the final step of the SDL code review process?
- Conduct a preliminary scan
- Define the objectives of the security code review
- Identify security concerns specific to the system architecture
- Analyze the code for general security vulnerabilities
Explanation
Explanation:
Correct answer: Analyze the code for general security vulnerabilities
In the SDL (Security Development Lifecycle) code review process, the final step is to analyze the code for general security vulnerabilities. This is where the reviewer performs a detailed examination of the code to identify common security issues such as input validation problems, insecure functions, or logic flaws. The earlier steps focus on preparation and context: defining objectives sets the purpose of the review, identifying architecture-specific concerns tailors the review to system design risks, and conducting a preliminary scan helps surface obvious issues before deeper analysis.
A product team, consisting of a scrum master, a business analyst, two developers, and a quality assurance tester are on a video call with the product owner. The team is reviewing a list to determine how many they feel can be added to their backlog and completed within the next two week iteration. Which scrum ceremony is the team participating in
-
Sprint planning
-
Daily scrum
-
Sprint review
-
Sprint retrospective
Explanation
Correct Answer:
a) Sprint planning
Explanation:
In Sprint Planning, the scrum team collaborates to review the backlog and decide which items will be included in the upcoming sprint. The goal is to determine how much work the team can complete in the next iteration (typically two weeks).
Why other options are wrong:
b) Daily scrum: The Daily Scrum (also known as the Daily Standup) is a brief meeting held every day during the sprint to discuss progress, impediments, and plans for the next 24 hours.
c) Sprint review: The Sprint Review is a meeting held at the end of the sprint to demonstrate the completed work and discuss whether the sprint goals were met, not to plan the next sprint.
d) Sprint retrospective: The Sprint Retrospective takes place after the Sprint Review and focuses on reflecting on the sprint's process and identifying areas for improvement for the next sprint.
Which type of manual code review technique is being used when the reviewer starts at an input control and traces its value through the application to each of the value’s outputs?
- Data flow analysis
- Control flow analysis
- Threat analysis
- Risk analysis
Explanation
Explanation:
Correct answer: Data flow analysis
When a reviewer follows the path of input data through an application—starting from an input point and tracing how that data moves and where it is eventually used or output—they are performing data flow analysis. This technique focuses on how data is processed, transformed, and propagated through the system, which helps identify issues like injection vulnerabilities or improper handling of sensitive input. Control flow analysis, on the other hand, focuses on the order in which program instructions are executed. Threat analysis evaluates potential security threats, and risk analysis assesses the likelihood and impact of those threats.
During fuzz testing of the new product, random values were entered into input elements. Search requests were sent to the correct API endpoint, but many of them failed during execution due to type mismatches. How should existing security controls be adjusted to prevent this in the future?
- Ensure all requests and responses are encrypted
- Ensure all user input data is validated prior to transmitting requests
- Ensure the contents of authentication cookies are encrypted
- Ensure sensitive transactions can be traced through an audit log
Explanation
Explanation:
Correct answer: Ensure all user input data is validated prior to transmitting requests
The issue described is caused by invalid or unexpected input types being sent to the API, resulting in execution failures. This is a classic input validation problem. The correct mitigation is to validate user input before it is sent to the server, ensuring that only properly formatted and expected data types are transmitted. This prevents malformed or random fuzzing inputs from reaching the API and causing errors. The other options do not address the root cause: encryption protects data confidentiality, cookies relate to session management, and audit logs help with tracking but do not prevent invalid input from being processed.
Which security assessment deliverable defines measures that will be periodically reported to management
-
Metrics template
-
Product risk profile
-
SDL project outline
-
Threat profile
Explanation
Correct Answer:
a) Metrics template
Explanation:
A metrics template defines the specific measures, key performance indicators (KPIs), and metrics that will be periodically reported to management. This deliverable ensures that the progress and effectiveness of security initiatives are tracked and communicated over time.
Why other options are wrong:
b) Product risk profile: This provides a snapshot of risks associated with a specific product, but it doesn't typically outline periodic reporting measures for management.
c) SDL project outline: This outlines the stages of the Secure Development Lifecycle (SDL), but it doesn't specifically define periodic measures for management.
d) Threat profile: This assesses and categorizes threats, but doesn't define reporting measures for management.
The software security team is performing security testing on a new software product using a testing tool that scans the running application for known exploits. Which security testing technique is being used
-
Automated vulnerability scanning
-
Property-based testing
-
Source-code analysis
-
Penetration testing
Explanation
Correct Answer:
a) Automated vulnerability scanning
Explanation:
Automated vulnerability scanning involves using a tool to scan an application for known vulnerabilities and exploits. It checks the running application for common vulnerabilities, typically based on a database of known exploits. This process is automated and helps identify security weaknesses.
Why other options are wrong:
b) Property-based testing: This is a technique used to test certain properties of the system (like security properties), but it does not specifically scan for known exploits.
c) Source-code analysis: This involves reviewing the actual source code for security flaws but does not scan the running application or check for known exploits in the same way automated vulnerability scanning does.
d) Penetration testing: This is a manual, simulated attack on the application, performed by security professionals to find vulnerabilities. It is more hands-on compared to automated scanning tools.
What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings for the user
-
P1 high privacy risk
-
P2 moderate privacy risk
-
P3 low privacy risk
-
P4 no privacy risk
Explanation
Correct Answer:
a) P1 high privacy risk
Explanation:
The application stores personally identifiable information (PII), which is inherently high-risk in terms of privacy. Additionally, ongoing transfers of data (even if anonymized) and the ability to change user settings further increase the potential for misuse or exposure of sensitive data. Therefore, this application is categorized with a high privacy risk.
Why other options are wrong:
b) P2 moderate privacy risk: While the app does deal with PII and has ongoing data transfers, the presence of settings changes makes it a higher risk than moderate.
c) P3 low privacy risk: Storing PII and monitoring users increases privacy risks beyond what would be classified as low.
d) P4 no privacy risk: Storing PII and transferring data, even anonymously, involves significant privacy risks, so it cannot be classified as having no privacy risk.
What is an advantage of using the Agile development methodology
-
Customer satisfaction is improved through rapid and continuous delivery of useful software.
-
Each stage is clearly defined, making it easier to assign clear roles to teams and departments who feed into the project.
-
The overall plan fits very neatly into a Gantt chart so a project manager can easily view the project timeline.
-
There is much less predictability throughout the project regarding deliverables.
Explanation
Correct Answer:
a) Customer satisfaction is improved through rapid and continuous delivery of useful software.
Explanation:
One of the key advantages of the Agile methodology is its focus on delivering small, incremental pieces of functional software quickly and consistently. This approach helps to meet customer needs more effectively and increases their satisfaction through continuous delivery of useful software.
Why other options are wrong:
b) Agile is iterative and flexible, and its stages are not rigidly defined. It focuses more on collaboration than clearly defined stages.
c) Agile does not fit neatly into traditional project management tools like Gantt charts. It focuses on flexibility and adaptability, rather than a fixed timeline.
d) While Agile embraces change, it does not imply a lack of predictability in deliverables. It aims for predictable, incremental delivery through sprints, making it more predictable than some other methods.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
The course focuses on secure coding principles, software vulnerabilities, authentication mechanisms, cryptography, and best practices for designing secure applications.
Secure software design helps prevent cyber threats such as SQL Injection, Cross-Site Scripting (XSS), authentication bypasses, and data breaches, ensuring application security and compliance with industry standards.
The course covers vulnerabilities like SQL Injection, XSS, Cross-Site Request Forgery (CSRF), insecure authentication, weak cryptography, and improper error handling.
Using prepared statements and parameterized queries is the most effective method to prevent SQL Injection, as it ensures user input is treated strictly as data, not executable code.
XSS occurs when an attacker injects malicious scripts into web pages viewed by users. It can be prevented by sanitizing and encoding user input, using a Content Security Policy (CSP), and avoiding innerHTML in JavaScript.
MFA requires users to verify their identity using multiple factors (e.g., password + one-time code). It significantly enhances security by preventing unauthorized access, even if a password is compromised.
Authentication verifies a user’s identity (e.g., username and password). Authorization determines what actions or data a user is allowed to access after authentication.