Secure Software Design (D487)
Access The Exact Questions for Secure Software Design (D487)
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock Actual Exam Questions and Answers for Secure Software Design (D487) on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Need Practice Questions for Secure Software Design (D487) ? Try studying with 150 + questions shared by our website
Free Secure Software Design (D487) Questions
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying code that can cause unexpected behavior and application failure. Which security testing technique is being used
-
Binary fault injection
-
Fuzz testing
-
Dynamic code analysis
-
Source-code fault injection
Explanation
Correct Answer:
d) Source-code fault injection
Explanation:
Source-code fault injection involves modifying the source code to intentionally introduce errors or vulnerabilities, testing how the application responds to these faults. This method is done at the code level, which matches the scenario described where the team is modifying the source code repository to test for vulnerabilities and unexpected behavior.
Why other options are wrong:
a) Binary fault injection: This involves injecting faults at the binary level (compiled code), not the source code level.
b) Fuzz testing: While fuzz testing involves providing random or unexpected inputs to an application to detect vulnerabilities, it doesn’t involve modifying the source code directly.
c) Dynamic code analysis: This is typically a technique used to analyze code behavior during execution, usually to identify security issues or vulnerabilities in runtime, not by injecting faults at the source code level.
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot
-
Session management
-
Data protection
-
Access control
-
Communication security
Explanation
Correct Answer:
c) Access control
Explanation:
Access control involves implementing a centralized authorization mechanism that restricts access to resources based on user roles and permissions. If the application cannot authenticate or authorize a user properly, access should be locked down to prevent unauthorized access.
Why other options are wrong:
a) Session management: Session management ensures that user sessions are securely created, maintained, and terminated but does not specifically address the application-level authorization process.
b) Data protection: Data protection focuses on safeguarding sensitive data, such as encryption or ensuring data confidentiality, integrity, and availability, rather than access control or authorization.
d) Communication security: Communication security ensures that data transmitted between systems is protected (e.g., through encryption), but it doesn't involve locking down the application based on authorization failures.
A legacy application has been replaced by a new product that provides mobile capabilities to the company's customer base. The two products have run concurrently for a week to provide a fallback if the new product experienced a large-scale failure. The time has come to turn off access to the legacy application. Which phase of the software development Life Cycle (SDLC) is being described
-
End of life
-
Planning
-
Maintenance
-
Design
Explanation
Correct Answer:
a) End of life
Explanation:
The End of Life phase refers to the point at which a product is no longer supported or maintained, and the system is retired. In this case, the legacy application is being phased out after running concurrently with the new product.
Why other options are wrong:
b) Planning: The Planning phase occurs at the beginning of the SDLC, where the project scope, goals, and timelines are defined, not after a product is replaced.
c) Maintenance: The Maintenance phase happens after deployment, where the system continues to be supported, patched, and updated, but the legacy application is being retired here, not maintained.
d) Design: The Design phase focuses on the blueprint of the system's structure and features, which occurs before the development and deployment of the software.
Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, objects, and file handles are destroyed once the application no longer needs them
-
Input validation
-
Session management
-
Data protection
-
Memory management
Explanation
Correct Answer:
d) Memory management
Explanation:
Memory management is a key secure coding practice that involves ensuring buffers are allocated with the correct size to avoid buffer overflow vulnerabilities, truncating input strings to reasonable lengths, and properly destroying resources, objects, and file handles when they are no longer needed. This helps prevent memory leaks, resource exhaustion, and other vulnerabilities related to improper management of memory and resources.
Why other options are wrong:
a) Input validation: This practice ensures that inputs are validated and sanitized to prevent malicious data from entering the system, but it doesn’t directly relate to managing memory, buffers, or resources.
b) Session management: This focuses on securely handling user sessions, including authentication, timeout management, and secure session storage, but it doesn't address memory management or resource allocation.
c) Data protection: This practice focuses on protecting sensitive data during storage, processing, and transmission, not directly on memory management or resource handling.
During fuzz testing of the new product, an exception was thrown on the order entry view which caused a full stack dump to be displayed in the browser window that included source code. How should existing security controls be adjusted to prevent this in the future
-
Ensure sensitive information is scrubbed from all error messages
-
Ensure privileges are restored after application exceptions
-
Ensure private information is not logged
-
Ensure all exceptions are handled in a standardized way
Explanation
Correct Answer:
a) Ensure sensitive information is scrubbed from all error messages
Explanation:
When an exception causes detailed information like source code or stack dumps to be displayed in an error message, it can potentially expose sensitive information about the application's structure, logic, or internal workings, creating a security vulnerability. To prevent this, sensitive data such as stack traces and internal logic should be scrubbed from error messages before they are displayed to the user. Error messages should provide minimal information, especially to unauthorized users.
Why other options are wrong:
b) Ensure privileges are restored after application exceptions: While restoring privileges might be important in some contexts, this is not directly related to preventing the exposure of internal information through error messages.
c) Ensure private information is not logged: While important, this is more about logging sensitive data rather than preventing detailed errors from being shown in the UI. The issue here concerns error message handling rather than logging.
d) Ensure all exceptions are handled in a standardized way: While handling exceptions in a standardized way is a good practice, the key concern here is specifically about scrubbing sensitive information from error messages before they are displayed to users, not the handling of exceptions themselves.
A software security team recently completed an internal assessment of the company's security assurance program. The team delivered a set of scorecards to leadership and changes designed to improve low-scoring governance, development, and deployment functions. Which software security maturity model did the team use
-
International Organization for Standardization ISO/IEC 27034
-
U.S. Department of Homeland Security Software Assurance Program
-
Building Security In Maturity Model (BSIMM)
-
Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
Explanation
Correct Answer:
d) Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
Explanation:
The OWASP Open Software Assurance Maturity Model (SAMM) is designed to assess and improve an organization's software assurance program. It uses scorecards to measure and track progress across various security domains, including governance, development, and deployment, which aligns with the situation described.
Why other options are wrong:
a) International Organization for Standardization ISO/IEC 27034: This standard focuses on the integration of security in software development but is not structured in terms of maturity assessments using scorecards.
b) U.S. Department of Homeland Security Software Assurance Program: This program provides guidance for secure software development but does not use scorecards in the same way as SAMM.
c) Building Security In Maturity Model (BSIMM): BSIMM is an industry framework to assess the maturity of software security initiatives but focuses more on practices rather than the specific scoring and improvement approach used in SAMM.
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retry. Which secure coding practice is this describing
-
Data protection
-
Input validation
-
Authentication
-
Access control
Explanation
Correct Answer:
a) Data protection
Explanation:
Data protection focuses on safeguarding sensitive information, including ensuring that personally identifiable information (PII) is not exposed and implementing mechanisms that prevent unauthorized actions (such as printing private documents or attempting unauthorized retries). It includes practices to secure data both in transit and at rest, ensuring privacy and confidentiality.
Why other options are wrong:
b) Input validation: Input validation ensures that input data is correct and sanitized but does not address the protection of sensitive information or prevent unauthorized actions such as printing private documents.
c) Authentication: Authentication verifies the identity of users, but this practice focuses more on protecting data and controlling actions, not on verifying user identity.
d) Access control: Access control deals with restricting what actions a user can perform based on their role and permissions, but in this case, the main focus is on safeguarding the data itself, not merely controlling access to it.
Which secure software design principle states that it is always safer to require agreement of more than one entity to make changes
-
Psychological acceptability
-
Separation of privileges
-
Total mediation
-
Least privilege
Explanation
Correct Answer:
b) Separation of privileges
Explanation:
The principle of separation of privileges states that it is safer to require the approval or action of more than one entity before making changes, particularly when sensitive operations are involved. This is a security measure to ensure that no single individual or component has too much control or can make changes without oversight.
Why other options are wrong:
a) Psychological acceptability: This principle is about designing security measures that are user-friendly and understandable. It does not involve requiring agreement from multiple entities to make changes.
c) Total mediation: This principle ensures that every access to resources is checked and validated, but it does not focus on requiring multiple entities for decision-making or changes.
d) Least privilege: This principle grants users only the permissions necessary for their tasks, but it does not imply that multiple entities must agree to make changes.
After every other security analysis technique has been used, what kind of security analysis involves going over the source code line by line?
-
Static analysis
-
Fuzz testing
-
Manual code review
-
Dynamic analysis
Explanation
Correct Answer:
c) Manual code review
Explanation:
Manual code review involves security experts reviewing the source code line-by-line to identify potential vulnerabilities. It is usually performed after other automated security analysis techniques have been completed to ensure thorough inspection. This process is essential for finding logic errors, security flaws, and issues that automated tools may miss.
Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized
-
Error handling and logging
-
Authentication and password management
-
Input validation
-
System configuration
Explanation
Correct Answer:
a) Error handling and logging
Explanation:
Error handling and logging are crucial to ensure sensitive information is not exposed in error messages or logs. Developers should avoid displaying stack traces, database details, or other internal information in error messages shown to users. These details could potentially be exploited by attackers. Instead, generic error messages should be provided, and detailed information should be logged securely for internal purposes.
Why other options are wrong:
b) Authentication and password management: While critical for securing user identities, this practice primarily focuses on controlling access, not on preventing the disclosure of sensitive information in responses.
c) Input validation: Input validation helps to prevent injection attacks and other malicious inputs, but it doesn’t specifically address the risk of disclosing sensitive information in error messages.
d) System configuration: Proper configuration of the system (e.g., disabling directory listing) is important for security, but it doesn't directly prevent sensitive information from being disclosed in responses to users.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
The course focuses on secure coding principles, software vulnerabilities, authentication mechanisms, cryptography, and best practices for designing secure applications.
Secure software design helps prevent cyber threats such as SQL Injection, Cross-Site Scripting (XSS), authentication bypasses, and data breaches, ensuring application security and compliance with industry standards.
The course covers vulnerabilities like SQL Injection, XSS, Cross-Site Request Forgery (CSRF), insecure authentication, weak cryptography, and improper error handling.
Using prepared statements and parameterized queries is the most effective method to prevent SQL Injection, as it ensures user input is treated strictly as data, not executable code.
XSS occurs when an attacker injects malicious scripts into web pages viewed by users. It can be prevented by sanitizing and encoding user input, using a Content Security Policy (CSP), and avoiding innerHTML in JavaScript.
MFA requires users to verify their identity using multiple factors (e.g., password + one-time code). It significantly enhances security by preventing unauthorized access, even if a password is compromised.
Authentication verifies a user’s identity (e.g., username and password). Authorization determines what actions or data a user is allowed to access after authentication.