D487 Review Question with 100% Verified
Answers
Security Development Lifecycle
a structured process for integrating security activities throughout the software development
lifecycle.
SDL A1
Security Assessment (Discovery) - Assess software requirements and risks; plan security
activities early.
Key success factors of SDL A1
Accurate product risk profile, accurate threat profile, regulatory coverage, clear security
objectives, correct SDL planning.
Core deliverables of SDL A1
Product risk profile, SDL project outline, applicable laws and regulations, threat profile,
certification requirements, third-party software list, metrics template.
type of thinking - SDL A1
Business risk, compliance, planning, and threat awareness.
SDL A2
Architecture - Examine security principles within the SDLC through architectural analysis.
Key activities in SDL A2
Create DFDs, perform STRIDE threat modeling, identify architectural threats, develop
mitigation strategies.
, Key success factors of SDL A2
Accurate DFDs, effective threat modeling, architectural risk analysis, CIA impact
consideration.
Core deliverables of SDL A2
DFDs, threat modeling artifacts, architecture threat analysis, risk mitigation plan, policy
compliance analysis.
Mental shortcut for SDL A2
"Draw it, decompose it, threat model it."
SDL A3
Design & Development - Evaluate and plan software security testing and design security.
Key activities in SDL A3
Create security test plans, perform design security reviews, update threat models, conduct
privacy implementation assessments.
Core deliverables of SDL A3
Security test plans, updated threat models, design security review, updated policy compliance
analysis.
What differentiates A3 from A2?
A2 analyzes architecture; A3 plans and reviews security testing and design decisions.
SDL A4
Readiness - Evaluate the effectiveness of security testing and remediation.
Key activities in SDL A4
Answers
Security Development Lifecycle
a structured process for integrating security activities throughout the software development
lifecycle.
SDL A1
Security Assessment (Discovery) - Assess software requirements and risks; plan security
activities early.
Key success factors of SDL A1
Accurate product risk profile, accurate threat profile, regulatory coverage, clear security
objectives, correct SDL planning.
Core deliverables of SDL A1
Product risk profile, SDL project outline, applicable laws and regulations, threat profile,
certification requirements, third-party software list, metrics template.
type of thinking - SDL A1
Business risk, compliance, planning, and threat awareness.
SDL A2
Architecture - Examine security principles within the SDLC through architectural analysis.
Key activities in SDL A2
Create DFDs, perform STRIDE threat modeling, identify architectural threats, develop
mitigation strategies.
, Key success factors of SDL A2
Accurate DFDs, effective threat modeling, architectural risk analysis, CIA impact
consideration.
Core deliverables of SDL A2
DFDs, threat modeling artifacts, architecture threat analysis, risk mitigation plan, policy
compliance analysis.
Mental shortcut for SDL A2
"Draw it, decompose it, threat model it."
SDL A3
Design & Development - Evaluate and plan software security testing and design security.
Key activities in SDL A3
Create security test plans, perform design security reviews, update threat models, conduct
privacy implementation assessments.
Core deliverables of SDL A3
Security test plans, updated threat models, design security review, updated policy compliance
analysis.
What differentiates A3 from A2?
A2 analyzes architecture; A3 plans and reviews security testing and design decisions.
SDL A4
Readiness - Evaluate the effectiveness of security testing and remediation.
Key activities in SDL A4
