The software security team prepared a detailed schedule napping security development lifecycle phases to the type of analysis they will execute.Which design and development deliverable aid the team prepare?
Answer(s): D
The deliverable that would aid a software security team in preparing a detailed schedule mapping security development lifecycle phases to the type of analysis they will execute is Security test plans. These plans are crucial as they outline the testing strategies and specific security tests that will be conducted during the development lifecycle to ensure the software meets the required security standards.Security test plans are developed after the requirements and design phases and are used throughout the implementation, verification, and release phases. They include detailed instructions for security testing, criteria for success, and the types of security testing to be performed, such as static and dynamic analysis, penetration testing, and code review. These plans are living documents that should be updated as new threats are identified and as the project evolves. They ensure that all team members understand the security goals, the risks, and the measures that need to be taken to mitigate those risks. By having a well-defined security test plan, the team can ensure that security is not an afterthought but is integrated into every phase of the software development lifecycle, thus producing more secure software.
The importance of security test plans in the software development lifecycle is supported by best practices and guidelines from sources such as Microsoft's Security Development Lifecycle1 and Snyk's Secure Software Development Life Cycle principles2.
The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.Which security testing technique is being used?
Answer(s): A
Fuzz testing is the ideal technique in this scenario. Here's why:Focus on Integrations: The scenario emphasizes testing links between the software, databases, web servers, and web services. Fuzz testing is specifically designed to find vulnerabilities in how software handles data and communication between components.Pre-release Testing: The product being close to release indicates a critical need to identify security flaws before public deployment. Fuzz testing is effective in uncovering unexpected behavior and potential vulnerabilities.Fuzz Testing Targets: Fuzz testing works by injecting invalid or unexpected data into interfaces (like those between databases, web components, etc.) to observe how the software reacts. This helps expose potential security gaps and weaknesses.
The software security team is performing security testing on a new software product using a testing tool that scans the running application for known exploit signatures.Which security testing technique is being used?
The security testing technique that involves using a testing tool to scan a running application for known exploit signatures is known as Automated Vulnerability Scanning. This method is part of dynamic analysis, which assesses the software in its running state to identify vulnerabilities that could be exploited by attackers. Automated vulnerability scanning tools are designed to detect and report known vulnerabilities by comparing the behavior and outputs of the application against a database of known exploit signatures1.
1: Application Security Testing: Tools, Types and Best Practices | GitHub
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:Which technique should be used to detect this vulnerability without running the source codes?
Answer(s): C
Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code's structure, syntax, and data flow.
Static analysis as a means to identify security vulnerabilities1. The importance of static analysis in the early stages of the SDLC to prevent security issues2. Learning-based approaches to fix SQL injection vulnerabilities using static analysis3.
Which design and development deliverable contains the types of evaluations that were performed, how many times they were performed, and how many times they were re-evaluated?
Security testing reports are the most likely deliverables to contain detailed records of evaluations, their frequency, and re-evaluations. Here's why:Purpose of Security Testing Reports: These reports document the results of security testing, including:Types of tests: Vulnerability scans, penetration tests, code reviews, etc. Frequency: How often tests were conducted (e.g., per build, per release cycle). Re-evaluations: If vulnerabilities were discovered, these reports will track whether and how often those were retested after remediation.Focus on Testing: The question specifically emphasizes evaluations, which aligns with the core content of security testing reports.
Post your Comments and Discuss WGU Secure-Software-Design exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Secure-Software-Design content, but please register or login to continue.