D487 SECURE SW DESIGN QUESTIONS AND
ACCURATE ANSWERS|ALREADY GRADED
A+|BRAND NEW!!!
A software security team member has been tasked with creating a
deliverable that provides details on where and to what degree sensitive
customer information is collected, stored, or created within a new product
offering. What does the team member need to deliver in order to meet the
objective? - ANSWER✔✔Privacy impact assessment
Which of the Ship (A5) deliverables of the security development cycle are
performed with A5 policy compliance analysis? - ANSWER✔✔analyze
activities and standards
What are the two deliverables of the Architecture phase of the SDL? -
ANSWER✔✔threat modeling artifacts, policy compliance analysis
What SDL security assessment deliverable is used as an input to an SDL
architecture process? - ANSWER✔✔threat profile
What is alpha level testing? - ANSWER✔✔testing done by the developers
themselves
What is beta level testing? - ANSWER✔✔testing done by those not familiar
with the actual development of the system
,What is black box testing? - ANSWER✔✔tests from an external
perspective with no prior knowledge of the software
What is the third phase of the security development life cycle, in which you
analyze and test software to determine security and privacy issues as you
make informed decisions moving forward with your software? -
ANSWER✔✔A3 Design and Development
What are external resources? - ANSWER✔✔resources hired on a
Which of the Ship (A5) deliverables of the security development cycle are
performed with code-assisted penetration testing? - ANSWER✔✔white-
box security testing
Which business function of OpenSAMM is associated with the following
core practices, deployment? - ANSWER✔✔vulnerability management
What should the PIA include? - ANSWER✔✔summary of legislation,
required process steps, technologies and techniques, and additional
resources
What is the primary task of the PIA process? - ANSWER✔✔to determine
the need in the system, along with an initial definition of the problem to be
solved.
Which of the Ship (A5) deliverables of the security development cycle are
performed with open-source licensing review? - ANSWER✔✔license
compliance
, Which of the Ship (A5) deliverables of the security development cycle are
performed with final security review? - ANSWER✔✔release and ship
Which phase of penetration testing allows for remediation to be
performed? - ANSWER✔✔deploy
Which key deliverable occurs during post-release support? -
ANSWER✔✔Third-party reviews
Which business function of OpenSAMM is associated with the following
core practices, governance? - ANSWER✔✔policy and compliance
Which business function of OpenSAMM is associated with the following
core practices, construction? - ANSWER✔✔threat assessment
Which business function of OpenSAMM is associated with the following
core practices, verification? - ANSWER✔✔code review
Which practice in the Ship (A5) phase of the security development cycle
verifies whether the product meets security mandates? - ANSWER✔✔A5
policy compliance analysis
Which post-release support activity defines the process to communicate,
identify, and alleviate security threats? - ANSWER✔✔PRSA1: External
vulnerability disclosure response
ACCURATE ANSWERS|ALREADY GRADED
A+|BRAND NEW!!!
A software security team member has been tasked with creating a
deliverable that provides details on where and to what degree sensitive
customer information is collected, stored, or created within a new product
offering. What does the team member need to deliver in order to meet the
objective? - ANSWER✔✔Privacy impact assessment
Which of the Ship (A5) deliverables of the security development cycle are
performed with A5 policy compliance analysis? - ANSWER✔✔analyze
activities and standards
What are the two deliverables of the Architecture phase of the SDL? -
ANSWER✔✔threat modeling artifacts, policy compliance analysis
What SDL security assessment deliverable is used as an input to an SDL
architecture process? - ANSWER✔✔threat profile
What is alpha level testing? - ANSWER✔✔testing done by the developers
themselves
What is beta level testing? - ANSWER✔✔testing done by those not familiar
with the actual development of the system
,What is black box testing? - ANSWER✔✔tests from an external
perspective with no prior knowledge of the software
What is the third phase of the security development life cycle, in which you
analyze and test software to determine security and privacy issues as you
make informed decisions moving forward with your software? -
ANSWER✔✔A3 Design and Development
What are external resources? - ANSWER✔✔resources hired on a
Which of the Ship (A5) deliverables of the security development cycle are
performed with code-assisted penetration testing? - ANSWER✔✔white-
box security testing
Which business function of OpenSAMM is associated with the following
core practices, deployment? - ANSWER✔✔vulnerability management
What should the PIA include? - ANSWER✔✔summary of legislation,
required process steps, technologies and techniques, and additional
resources
What is the primary task of the PIA process? - ANSWER✔✔to determine
the need in the system, along with an initial definition of the problem to be
solved.
Which of the Ship (A5) deliverables of the security development cycle are
performed with open-source licensing review? - ANSWER✔✔license
compliance
, Which of the Ship (A5) deliverables of the security development cycle are
performed with final security review? - ANSWER✔✔release and ship
Which phase of penetration testing allows for remediation to be
performed? - ANSWER✔✔deploy
Which key deliverable occurs during post-release support? -
ANSWER✔✔Third-party reviews
Which business function of OpenSAMM is associated with the following
core practices, governance? - ANSWER✔✔policy and compliance
Which business function of OpenSAMM is associated with the following
core practices, construction? - ANSWER✔✔threat assessment
Which business function of OpenSAMM is associated with the following
core practices, verification? - ANSWER✔✔code review
Which practice in the Ship (A5) phase of the security development cycle
verifies whether the product meets security mandates? - ANSWER✔✔A5
policy compliance analysis
Which post-release support activity defines the process to communicate,
identify, and alleviate security threats? - ANSWER✔✔PRSA1: External
vulnerability disclosure response
