Prepare Top WGU Secure-Software-Design Exam Study Guide Practice Questions Edition
Go to Secure-Software-Design Questions - Try Secure-Software-Design dumps pdf
NEW QUESTION # 12
A potential threat was discovered during automated system testing when a PATCH request sent to the API caused an unhandled server exception. The API only supports GET. POST. PUT,and DELETE requests.
How should existing security controls be adjusted to prevent this in the future?
- A. Use API keys to enforce authorization of every request
- B. Property configure acceptable API requests
- C. Enforce role-based authorization
- D. Ensure audit logs are in place for sensitive transactions
Answer: B
Explanation:
The issue described involves a PATCH request causing an unhandled server exception because the API does not support this method. The most direct and effective way to prevent such exceptions is to ensure that the API is configured to accept only the supported request methods: GET, POST, PUT, and DELETE. This can be achieved by implementing strict input validation to reject any requests that do not conform to thedefined API specifications, including the request method. By doing so, any requests using unsupported methods like PATCH will be immediately rejected, thus preventing the server from reaching an exception state.
References:
* OWASP's guidance on error and exception handling emphasizes the importance of managing exceptions in a centralized manner and ensuring that all unexpected behavior is correctly handled within the application1.
* Additional best practices for error handling in software development suggest the significance of input validation and the implementation of defensive programming techniques to prevent errors2.
* The OWASP Foundation also highlights the principle that all security mechanisms should deny access until specifically granted, which supports the approach of configuring acceptable API requests3.
NEW QUESTION # 13
Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?
- A. Data Protection
- B. Authentication and Password Management
- C. General Coding Practices
- D. Session Management
Answer: C
NEW QUESTION # 14
Which software-testing technique can be automated or semi-automated and provides invalid, unexpected, or random data to the inputs of a computer software program?
- A. Dynamic analysis
- B. Static analysis
- C. Bugtraq
- D. Fuzzing
Answer: D
Explanation:
Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs. Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols2.
References: 1: Wikipedia - Fuzzing 2: DZone - Fuzzing in Software Engineering
NEW QUESTION # 15
Which question reflects the security change management component of the change management process?
- A. How critical is the software to meeting the customers' mission?
- B. Which security objectives are required by the software?
- C. What threats are possible in the environment where the software will be operating?
- D. How is remote administration secured?
Answer: D
Explanation:
Option D best addresses security change management, here's why:
* Focus on Change: The question directly asks about a modification to how remote administration is secured. This aligns with the core goal of security change management, which is to evaluate and control the security implications of changes to systems.
* Security-Specific: The question is explicitly concerned with security, not general functionality or requirements.
* Practical Aspect: Remote administration access is a frequent target for attackers, making it a common area for security change management scrutiny.
NEW QUESTION # 16
Company leadership has contracted with a security firm to evaluate the vulnerabilityofall externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
- A. Source-code analysis
- B. Penetration testing
- C. Properly-based-testing
- D. Source-code fault injection
Answer: B
Explanation:
The security testing technique that involves evaluating the vulnerability of all externally facing enterprise applications through both automated and manual system interactions is known as Penetration Testing. This method simulates real-world attacks on systems to identify potential vulnerabilities that could be exploited by attackers. It is a proactive approach to discover security weaknesses before they can be exploited in a real attack scenario. Penetration testing can include a variety of methods such as network scanning, application testing, and social engineering tactics to ensure a comprehensive security evaluation.
References: The concept of Penetration Testing as a method for evaluating vulnerabilities aligns with industry standards and practices, as detailed in resources from security-focused organizations and literature1.
NEW QUESTION # 17
Which category classifies identified threats that have defenses in place and do not expose the application to exploits?
- A. Fully Mitigated Threat
- B. Unmitigated Threats
- C. Threat Profile
- D. Partially Mitigated Threat
Answer: A
NEW QUESTION # 18
The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP SAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?
- A. Construction
- B. Verification
- C. Deployment
- D. Governance
Answer: B
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The Open Web Application Security Project (OWASP) Software Assurance Maturity Model (SAMM) is a framework designed to help organizations assess and improve their software security posture. SAMM is structured around five primary business functions: Governance, Design, Implementation, Verification, and Operations.
In this scenario, the focus is on reviewing design artifacts to ensure compliance with organizational security standards. This activity aligns with the Verification business function within SAMM. The Verification function encompasses security practices related to assessing and validating the security of software artifacts throughout the development lifecycle. Key practices under this function include:
* Design Review: Evaluating design documents and models to identify potential security issues and ensure that security requirements are adequately addressed.
* Code Review: Analyzing source code to detect security vulnerabilities and ensure adherence to secure coding standards.
* Security Testing: Conducting various testing methodologies, such as penetration testing and vulnerability scanning, to identify and remediate security weaknesses in the software.
By focusing on the Verification function, the organization aims to proactively identify and address security concerns during the design and development phases, thereby enhancing the overall security posture of their software products.
References:
* OWASP SAMM - Verification
NEW QUESTION # 19
Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?
- A. Black box testing
- B. Dynamic testing
- C. Reasonableness testing
- D. White box testing
Answer: D
Explanation:
White box testing, also known as clear box testing, glass box testing, transparent box testing, and structural testing, is a method of software testing where the internal structure, design, and coding of the software are tested to verify the flow of input-output and to improve the design, usability, and security. It involves looking at the structures that are internal to the system, with the tester having knowledge of the internal workings of the product. This type of testing is concerned with examining the internal logical structures of the program and is typically performed by stepping through the code line by line to analyze the program for potential errors, which aligns with the description of the control test in question.
References:
* Control Structure Testing - GeeksforGeeks1
* What is White Box Testing? - BrowserStack2
* Software Testing Strategies Chapter 18 - IIT3
NEW QUESTION # 20
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:
Which technique should be used to detect this vulnerability without running the source codes?
- A. Dynamic analysis
- B. Cross-site scripting
- C. Static analysis
- D. Fuzz testing
Answer: C
Explanation:
Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code's structure, syntax, and data flow.
References:
* Static analysis as a means to identify security vulnerabilities1.
* The importance of static analysis in the early stages of the SDLC to prevent security issues2.
* Learning-based approaches to fix SQL injection vulnerabilities using static analysis3.
NEW QUESTION # 21
Which mitigation technique is used to fight against an identity spoofing threat?
- A. Require user authorization
- B. Encryption
- C. Filtering
- D. Audit trails
Answer: A
Explanation:
To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization.
This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for attackers to spoof an identity successfully.
References:
* Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.
* The National Security Agency's guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures2.
* Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks3.
* The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud4.
NEW QUESTION # 22
Which SDL security goal is defined as ensuring timely and reliable access to and use of information?
- A. Availability
- B. Information security
- C. Integrity
- D. Confidentiality
Answer: A
Explanation:
The term 'availability' in the context of Secure Software Development Lifecycle (SDL) refers to ensuring that systems, applications, and data are accessible to authorized userswhen needed. This means that the information must be timely and reliable, without undue delays or interruptions. Availability is a critical aspect of security, as it ensures that the software functions correctly and efficiently, providing users with the information they need to perform their tasks.
References:
* The definition of availability as per the National Institute of Standards and Technology (NIST) Glossary1.
* The Microsoft Security Development Lifecycle (SDL) which emphasizes the importance of availability in secure software design2.
* General principles of Secure Software Development Life Cycle (SSDLC) that include availability as a key security goal3.
NEW QUESTION # 23
The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one-time requirements, bucket requirements, and final security review requirements.
Which type of requirement slates that the team must identify primary security and privacy contacts?
- A. Every-sprint requirement
- B. Final security review requirement
- C. One-time requirement
- D. Bucket requirement
Answer: C
Explanation:
The OpenSAMM business function being assessed is Verification. This function involves activities related to reviewing and testing to ensure that the software meets the requiredsecurity standards and practices. In the context of the question, the software security group's focus on reviewing design artifacts to ensure compliance with organizational security standards falls under the Verification function. This includes tasks such as design review, implementation review, and security testing, which are all aimed at verifying that the security measures and controls are correctly integrated into the software design.
References: The information is verified as per the OWASP SAMM documentation, which outlines the Verification function as a core business function that encompasses activities like design review, which is directly related to the assessment of design artifacts mentioned in the question1.
NEW QUESTION # 24
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Spoofing
- B. Elevation of privilege
- C. Information disclosure
- D. Tampering
Answer: D
Explanation:
The type of threat described is Tampering. This threat occurs when an attacker intercepts and manipulates data being sent from the client to the server, such as formdata being submitted to an API. The attacker may alter the data to change the intended operation, inject malicious content, or compromise the integrity of the system. Tampering attacks are a significant concern in secure software design because they can lead to unauthorized changes and potentially harmful actions within the application.
References:
* Understanding the different types of API attacks and their prevention1.
* Comprehensive guide on API security and threat mitigation2.
* Detailed analysis of Man-in-the-Middle (MitM) attacks and their impact on API security3.
NEW QUESTION # 25
Which secure software design principle assumes attackers have the source code and specifications of the product?
- A. Separation of Privileges
- B. Open Design
- C. Total Mediation
- D. Psychological Acceptability
Answer: B
NEW QUESTION # 26
Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure credentials and authentication tokens are encrypted during transit
- B. Ensure passwords are encrypted when stored in persistent data stores
- C. Ensure strong password policies are enforced
- D. Ensure authentication controls are resistant to brute force attacks
Answer: D
NEW QUESTION # 27
What are the three primary goals of the secure software development process?
- A. Confidentiality, integrity, and availability
- B. Redundancy, scalability, and portability
- C. Performance, reliability, and maintainability
- D. Cost, speed to market, and profitability
Answer: A
Explanation:
The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).
* Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
* Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
* Availability ensures that information and resources are accessible to authorized users when needed. This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.
References: The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3.
NEW QUESTION # 28
Using a web-based common vulnerabilityscoringsystem (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component.The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal andenvironmental metrics.
Which rating would CVSS assign this vulnerability?
- A. Medium severity
- B. High severity
- C. Low severity
- D. Critical severity
Answer: B
Explanation:
The Common Vulnerability Scoring System (CVSS) uses the following ranges to determine the severity rating of a vulnerability:
* 0.1 - 3.9: Low severity
* 4.0 - 6.9: Medium severity
* 7.0 - 8.9: High severity
* 9.0 - 10.0: Critical severity
Since the adjusted score for the vulnerability is 5.9, it falls within theHigh severityrange.
References:
* CVSS v3.1 Specification Document - FIRST: https://www.first.org/cvss/specification-document
* National Vulnerability Database (NVD) - NIST: https://nvd.nist.gov/vuln-metrics/cvss
NEW QUESTION # 29
Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only those needed for the business purpose?
- A. Data protection
- B. Communication security
- C. Memory management
- D. File management
Answer: D
Explanation:
The secure coding best practice that requires authentication before allowing any files to be uploaded, and limits the types of files to only those needed for the business purpose, falls under the category of File Management. This practice is crucial for preventing unauthorized file uploads, which can be a common vector for attacks such as uploading malicious files or scripts. By enforcing authentication, the application ensures that only legitimate users can upload files. Additionally, restricting the file types to those necessary for business operations minimizes the risk of uploading potentially harmful files that could compromise the system.
References:
* OWASP Secure Coding Practices1
* File Upload Security Best Practices | CodeHandbook2
* File Upload Protection - 10 Best Practices for Preventing ... - OPSWAT3
NEW QUESTION # 30
The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?
- A. Final security review
- B. Penetration testing
- C. Open-source licensing review
- D. Policy compliance analysis
Answer: C
Explanation:
The activity described pertains to the review of noncommercial software libraries to ensure compliance with the legal specifications set by the authors. This is part of the open-source licensing review, which is a critical activity in the Ship phase of the Security Development Lifecycle (SDL). This review ensures that all open-source components are used in accordance with their licenses, which is essential for legal and security compliance.
References: The Ship phase of the SDL includes various activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensingreview, and final security and privacy reviews12. The open-source licensing review specifically addresses the legal aspects of using third-party software components2.
NEW QUESTION # 31
Which category classifies identified threats that have some defenses in place and expose the application to limited exploits?
- A. Unmitigated Threats
- B. Threat Profile
- C. Fully Mitigated Threat
- D. Partially Mitigated Threat
Answer: D
NEW QUESTION # 32
What sitsbetween a browser and an internet connection and alters requests and responses in a way thedeveloper did not intend?
- A. Intercept proxy
- B. Input validation
- C. Load testing
- D. Reverse engineering
Answer: A
Explanation:
An intercept proxy, also known as a proxy server, sits between a web client (such as a browser) and an external server to filter, monitor, or manipulate the requests and responses passing through it. This can be used for legitimate purposes, such as security testing and user privacy, but it can also be exploited by attackers to alter web traffic in a way that the developer did not intend, potentially leading to security vulnerabilities.
References:
* Understanding of HTTP and HTTPS protocols12.
* Definition and role of proxy servers3.
NEW QUESTION # 33
The product development team is preparing for the production deployment of recent feature enhancements.
One morning, they noticed the amount of test data grew exponentially overnight. Most fields were filled with random characters, but some structured query language was discovered.
Which type of security development lifecycle (SDL) tool was likely being used?
- A. Dynamic analysis
- B. Static analysis
- C. Fuzzing
- D. Threat model
Answer: C
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The scenario described indicates that the system was subjected to inputs containing random data and some structured query language (SQL) statements, leading to an exponential increase in test data. This behavior is characteristic of fuzzing, a testing technique used to identify vulnerabilities by inputting a wide range of random or unexpected data into the system.
Fuzzing aims to discover coding errors and security loopholes by bombarding the application with malformed or unexpected inputs, observing how the system responds. The presence of random characters and SQL statements suggests that the fuzzing tool was testing for vulnerabilities such as SQL injection by injecting various payloads into the system.
This approach is part of the Verification business function in the OWASP SAMM, specifically within the Security Testing practice. Security testing involves evaluating the software to identify vulnerabilities that could be exploited, and fuzzing is a common technique employed in this practice to ensure the robustness and security of the application.
References:
* OWASP SAMM: Verification - Security Testing
NEW QUESTION # 34
......
Free Courses and Certificates Secure-Software-Design Exam Question: https://www.itexamsimulator.com/Secure-Software-Design-brain-dumps.html
Dumps Practice Exam Questions Study Guide for the Secure-Software-Design Exam: https://drive.google.com/open?id=1eLhAIBfuHLcJQ06ZUQZN9UvNfe3Tk1ag
