Which of the following best describes security by design?

Embed security at the architect level, rather than adding controls later

Which control best mitigates unauthorized access to development environments?

Network segmentation and access control lists (ACLs)

What is the biggest security risk in third-party software development?

Lack of visibility into security practices and supply chain risks

Which of the following is the primary objective of a secure system lifecycle process?

Ensuring security is embedded from design to decommissioning

Which of the following security testing methods is most effective in identifying runtime vulnerabilities?

Dynamic Application Security Testing (DAST)

Which of the following is most critical for ensuring security in the system development lifecycle (SDLC)?

Integrating security requirements from the initial planning phase

Which control best protects source code repositories from insider threats?

Role-based access control (RBAC) with least privilege enforcement

Which of the following best ensures continuous security integration into software development?

Using automated security tools in Continuous Deployment (CI/CD) pipeline

Which database security measure best protects against SQL injection attacks?

Using parameterized queries and prepared statements

studbud

Lesson 8

12 termsStudBud Administration

Imported from external platform

Flashcards12 cardsFPractice quizPHost liveL

Questions 12

Answers

1
Which of the following best describes security by design?
Implementing security controls only after software deployment
Releasing security patches quickly after vulnerabilities are discovered
Using security software to protect applications post-deployment
Embed security at the architect level, rather than adding controls later
2
Which control best mitigates unauthorized access to development environments?
Encryption of source code
Role-based security training for developers
Using static code analysis tools
Network segmentation and access control lists (ACLs)
3
Which testing method is most effective at identifying insecure API interactions?
Threat modeling
Fuzz testing
Black-box testing
Peer code review
4
What is the biggest security risk in third-party software development?
Non-disclosure agreements failing to cover security issues
Developers lacking secure coding expertise
Slow patching cycles for third-party software
Lack of visibility into security practices and supply chain risks
5
Which of the following is the primary objective of a secure system lifecycle process?
Ensuring rapid development and deployment
Ensuring security is embedded from design to decommissioning
Eliminating all software vulnerabilities before production
Reducing software development costs
6
Which SDLC model best supports continuous security improvements?
Agile
Waterfall
DevSecOps
Spiral
7
Which of the following security testing methods is most effective in identifying runtime vulnerabilities?
Code peer review
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Threat modeling
8
Which of the following is most critical for ensuring security in the system development lifecycle (SDLC)?
Integrating security requirements from the initial planning phase
Conducting a security assessment only after deployment
Delaying security measures until functional requirements are met
Using penetration testing as the sole security evaluation method
9
Which principle is most important for implementing secure database access control?
Data encryption
Least privilege
Multi-factor authentication
Role-based authentication
10
Which control best protects source code repositories from insider threats?
Implementing security training for software engineers
Enforcing multi-factor authentication on developer workstations
Requiring manual code reviews for all commits
Role-based access control (RBAC) with least privilege enforcement
11
Which of the following best ensures continuous security integration into software development?
Requiring developers to manually test for security flaws
Implementing security awareness training for developers
Using automated security tools in Continuous Deployment (CI/CD) pipeline
Conducting quarterly security code reviews
12
Which database security measure best protects against SQL injection attacks?
Conducting regular vulnerability scans
Limiting database user access rights
Enforcing database encryption
Using parameterized queries and prepared statements

Lesson 8 Flashcards | StudBud