Secure Software Design (D487)
Access The Exact Questions for Secure Software Design (D487)
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock 36 + Actual Exam Questions and Answers for Secure Software Design (D487) on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Need Practice Questions for Secure Software Design (D487) ? Try studying with 150 + questions shared by our website
Free Secure Software Design (D487) Questions
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retry. Which secure coding practice is this describing
-
Data protection
-
Input validation
-
Authentication
-
Access control
Explanation
Correct Answer:
a) Data protection
Explanation:
Data protection focuses on safeguarding sensitive information, including ensuring that personally identifiable information (PII) is not exposed and implementing mechanisms that prevent unauthorized actions (such as printing private documents or attempting unauthorized retries). It includes practices to secure data both in transit and at rest, ensuring privacy and confidentiality.
Why other options are wrong:
b) Input validation: Input validation ensures that input data is correct and sanitized but does not address the protection of sensitive information or prevent unauthorized actions such as printing private documents.
c) Authentication: Authentication verifies the identity of users, but this practice focuses more on protecting data and controlling actions, not on verifying user identity.
d) Access control: Access control deals with restricting what actions a user can perform based on their role and permissions, but in this case, the main focus is on safeguarding the data itself, not merely controlling access to it.
What is an advantage of using the Agile development methodology
-
Customer satisfaction is improved through rapid and continuous delivery of useful software.
-
Each stage is clearly defined, making it easier to assign clear roles to teams and departments who feed into the project.
-
The overall plan fits very neatly into a Gantt chart so a project manager can easily view the project timeline.
-
There is much less predictability throughout the project regarding deliverables.
Explanation
Correct Answer:
a) Customer satisfaction is improved through rapid and continuous delivery of useful software.
Explanation:
One of the key advantages of the Agile methodology is its focus on delivering small, incremental pieces of functional software quickly and consistently. This approach helps to meet customer needs more effectively and increases their satisfaction through continuous delivery of useful software.
Why other options are wrong:
b) Agile is iterative and flexible, and its stages are not rigidly defined. It focuses more on collaboration than clearly defined stages.
c) Agile does not fit neatly into traditional project management tools like Gantt charts. It focuses on flexibility and adaptability, rather than a fixed timeline.
d) While Agile embraces change, it does not imply a lack of predictability in deliverables. It aims for predictable, incremental delivery through sprints, making it more predictable than some other methods.
Which secure coding best practice says to use well-vetted algorithms to ensure that the application uses random identifiers, that identifiers are appropriately restricted to the processes, and are fully terminated on logout
-
Access control
-
Output encoding
-
Session management
-
Input validation
Explanation
Correct Answer:
c) Session management
Explanation:
Session management best practices ensure that session identifiers are generated using well-vetted algorithms, preventing attackers from guessing or predicting session IDs. It also ensures that identifiers are appropriately restricted to specific processes and are terminated properly during logout to prevent session hijacking or fixation attacks.
Why other options are wrong:
a) Access control: Access control focuses on managing and restricting user permissions to prevent unauthorized access to resources, but it doesn't deal with the management of session identifiers.
b) Output encoding: This practice ensures that data is safely encoded for output to prevent injection attacks like XSS (Cross-Site Scripting), but it doesn't address session management or identifier security.
d) Input validation: Input validation ensures that inputs are safe and properly formatted, preventing malicious input from affecting the system, but it doesn't directly address session handling or the secure management of session identifiers.
Which secure software design principle states that it is always safer to require agreement of more than one entity to make changes
-
Psychological acceptability
-
Separation of privileges
-
Total mediation
-
Least privilege
Explanation
Correct Answer:
b) Separation of privileges
Explanation:
The principle of separation of privileges states that it is safer to require the approval or action of more than one entity before making changes, particularly when sensitive operations are involved. This is a security measure to ensure that no single individual or component has too much control or can make changes without oversight.
Why other options are wrong:
a) Psychological acceptability: This principle is about designing security measures that are user-friendly and understandable. It does not involve requiring agreement from multiple entities to make changes.
c) Total mediation: This principle ensures that every access to resources is checked and validated, but it does not focus on requiring multiple entities for decision-making or changes.
d) Least privilege: This principle grants users only the permissions necessary for their tasks, but it does not imply that multiple entities must agree to make changes.
A legacy application has been replaced by a new product that provides mobile capabilities to the company's customer base. The two products have run concurrently for a week to provide a fallback if the new product experienced a large-scale failure. The time has come to turn off access to the legacy application. Which phase of the software development Life Cycle (SDLC) is being described
-
End of life
-
Planning
-
Maintenance
-
Design
Explanation
Correct Answer:
a) End of life
Explanation:
The End of Life phase refers to the point at which a product is no longer supported or maintained, and the system is retired. In this case, the legacy application is being phased out after running concurrently with the new product.
Why other options are wrong:
b) Planning: The Planning phase occurs at the beginning of the SDLC, where the project scope, goals, and timelines are defined, not after a product is replaced.
c) Maintenance: The Maintenance phase happens after deployment, where the system continues to be supported, patched, and updated, but the legacy application is being retired here, not maintained.
d) Design: The Design phase focuses on the blueprint of the system's structure and features, which occurs before the development and deployment of the software.
A _____ provides reports and statistics on employee demographics.
-
manufacturing information system
-
logistics information system
-
personnel information system
-
marketing information system
Explanation
Correct answer C: personnel information system
Explanation:
A personnel information system (also known as a Human Resource Information System, HRIS) is designed to manage employee-related data, including demographics, job history, payroll, benefits, and performance metrics. It generates reports and statistics to support HR decision-making.
Why the other options are incorrect:
A) manufacturing information system: This system focuses on production processes, equipment management, and inventory, not employee demographics.
B) logistics information system: This system deals with supply chain management, transportation, and procurement, which are unrelated to employee data.
D) marketing information system: This system gathers and analyzes market and customer data to support marketing strategies, not HR-related information.
Which category classifies identified threats that have some defenses in place and exposes the application to limited exploits
-
Unmitigated threats
-
Fully mitigated threat
-
Threat profile
-
Partially mitigated threat
Explanation
Correct Answer:
d) Partially mitigated threat
Explanation:
A partially mitigated threat has some defenses in place, but these defenses do not completely eliminate the risk. This leaves the application exposed to limited exploits, though not fully vulnerable.
Why other options are wrong:
a) Unmitigated threats: These threats have no defenses in place, leaving the application fully exposed to exploitation.
b) Fully mitigated threat: This refers to threats that are fully defended against, eliminating the possibility of exploitation.
c) Threat profile: This term refers to a broader categorization of threats and does not directly describe the status of mitigations or exposure.
Which architecture deliverable identifies the organization's tolerance to security issues and how the organization plans to react if a security issue occurs
-
Policy compliance analysis
-
Threat modeling artifacts
-
Business requirements
-
Risk mitigation plan
Explanation
Correct Answer:
d) Risk mitigation plan
Explanation:
A risk mitigation plan identifies the organization's tolerance for security issues and outlines how the organization will respond in the event of a security incident. This includes the strategies for reducing, transferring, or accepting risk, as well as incident response procedures.
Why other options are wrong:
a) Policy compliance analysis: This evaluates the adherence to security policies but doesn't focus on the organization's tolerance or response to security issues.
b) Threat modeling artifacts: These identify potential threats to the system, but they do not outline how the organization will react to those threats.
c) Business requirements: These outline the necessary features and functions of the system but do not address security risk tolerance or response strategies.
What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category
-
All administrative activities are logged and audited
-
Sensitive information is not logged
-
All exceptions are handled in a structured way
-
Inputs enforce type, format, length, and range checks
Explanation
Correct Answer:
d) Inputs enforce type, format, length, and range checks
Explanation:
The data validation/parameter validation threat category involves ensuring that inputs to a web application are properly validated to prevent malicious data from being processed. By enforcing type, format, length, and range checks on inputs, the application ensures that only valid data is accepted and reduces the risk of attacks such as SQL injection or buffer overflows.
Why other options are wrong:
a) All administrative activities are logged and audited: This is a good security practice for tracking and monitoring activities, but it is not directly related to data validation or parameter validation.
b) Sensitive information is not logged: While this is important for protecting sensitive data, it doesn't address the validation of user inputs.
c) All exceptions are handled in a structured way: Handling exceptions properly is important for application stability and security, but it is not specifically related to validating user inputs for correctness or security.
A software security team recently completed an internal assessment of the company's security assurance program. The team delivered a set of scorecards to leadership and changes designed to improve low-scoring governance, development, and deployment functions. Which software security maturity model did the team use
-
International Organization for Standardization ISO/IEC 27034
-
U.S. Department of Homeland Security Software Assurance Program
-
Building Security In Maturity Model (BSIMM)
-
Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
Explanation
Correct Answer:
d) Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
Explanation:
The OWASP Open Software Assurance Maturity Model (SAMM) is designed to assess and improve an organization's software assurance program. It uses scorecards to measure and track progress across various security domains, including governance, development, and deployment, which aligns with the situation described.
Why other options are wrong:
a) International Organization for Standardization ISO/IEC 27034: This standard focuses on the integration of security in software development but is not structured in terms of maturity assessments using scorecards.
b) U.S. Department of Homeland Security Software Assurance Program: This program provides guidance for secure software development but does not use scorecards in the same way as SAMM.
c) Building Security In Maturity Model (BSIMM): BSIMM is an industry framework to assess the maturity of software security initiatives but focuses more on practices rather than the specific scoring and improvement approach used in SAMM.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
The course focuses on secure coding principles, software vulnerabilities, authentication mechanisms, cryptography, and best practices for designing secure applications.
Secure software design helps prevent cyber threats such as SQL Injection, Cross-Site Scripting (XSS), authentication bypasses, and data breaches, ensuring application security and compliance with industry standards.
The course covers vulnerabilities like SQL Injection, XSS, Cross-Site Request Forgery (CSRF), insecure authentication, weak cryptography, and improper error handling.
Using prepared statements and parameterized queries is the most effective method to prevent SQL Injection, as it ensures user input is treated strictly as data, not executable code.
XSS occurs when an attacker injects malicious scripts into web pages viewed by users. It can be prevented by sanitizing and encoding user input, using a Content Security Policy (CSP), and avoiding innerHTML in JavaScript.
MFA requires users to verify their identity using multiple factors (e.g., password + one-time code). It significantly enhances security by preventing unauthorized access, even if a password is compromised.
Authentication verifies a user’s identity (e.g., username and password). Authorization determines what actions or data a user is allowed to access after authentication.