D487 SECURE SOFTWARE DESIGN
ACTUAL SCRIPT WITH 100 PERCENT
CORRECT ANSWERS
◉ What is the goal of design security review deliverables?
Answer: To make modifications to the design of software
components based on security assessments
◉ Which application scanner component is useful in identifying
vulnerabilities such as cookie misconfigurations and insecure
configuration of HTTP response headers?
Answer: Passive scanner
◉ Which type of attack occurs when an attacker uses malicious
code in the data sent in a form?
Answer: Cross-site scripting
◉ Which tools provide the given functions? - Self Managed
Automatic Code Review Product
Answer: SonarQube
◉ Which tools provide the given functions? - Proprietary issue
tracking product
Answer: JIRA
,◉ Which tools provide the given functions? - Open-source
automation server
Answer: Jenkins
◉ Which tools provide the given functions? - AI-Powered
managemnt soltuion
Answer: Dynatrace
◉ A new application is released, and users perform initial testing
on the application.
Which type of testing are the users performing?
Answer: Beta Testing
◉ What is a non-system-related component in software security
testing attack surface validation?
Answer: Users
◉ When an application's input validation is not handled properly,
it could result in which kind of vulnerabilities?
Answer: SQL injection, cross-site scripting
◉ What are the advantages of the following security analysis
tools? - Static Code Analysis
, Answer: Access to the actual instructions the software will be
guessing
◉ What are the advantages of the following security analysis
tools? - Dynamic Code Analysis
Answer: Tests a specific operational deployment
◉ What are the advantages of the following security analysis
tools? - Fuzz Testing
Answer: Testing in a random approach
◉ What are the advantages of the following security analysis
tools? - Manual Code Review
Answer: Requires no supporting Technology
◉ Which activity in the Ship (A5) phase of the security
development cycle sets requirements for quality gates that must
be met before release?
Answer: A5 policy compliance analysis
◉ Which post-release support activity should be completed when
companies are joining together?
Answer: Security architectural reviews
ACTUAL SCRIPT WITH 100 PERCENT
CORRECT ANSWERS
◉ What is the goal of design security review deliverables?
Answer: To make modifications to the design of software
components based on security assessments
◉ Which application scanner component is useful in identifying
vulnerabilities such as cookie misconfigurations and insecure
configuration of HTTP response headers?
Answer: Passive scanner
◉ Which type of attack occurs when an attacker uses malicious
code in the data sent in a form?
Answer: Cross-site scripting
◉ Which tools provide the given functions? - Self Managed
Automatic Code Review Product
Answer: SonarQube
◉ Which tools provide the given functions? - Proprietary issue
tracking product
Answer: JIRA
,◉ Which tools provide the given functions? - Open-source
automation server
Answer: Jenkins
◉ Which tools provide the given functions? - AI-Powered
managemnt soltuion
Answer: Dynatrace
◉ A new application is released, and users perform initial testing
on the application.
Which type of testing are the users performing?
Answer: Beta Testing
◉ What is a non-system-related component in software security
testing attack surface validation?
Answer: Users
◉ When an application's input validation is not handled properly,
it could result in which kind of vulnerabilities?
Answer: SQL injection, cross-site scripting
◉ What are the advantages of the following security analysis
tools? - Static Code Analysis
, Answer: Access to the actual instructions the software will be
guessing
◉ What are the advantages of the following security analysis
tools? - Dynamic Code Analysis
Answer: Tests a specific operational deployment
◉ What are the advantages of the following security analysis
tools? - Fuzz Testing
Answer: Testing in a random approach
◉ What are the advantages of the following security analysis
tools? - Manual Code Review
Answer: Requires no supporting Technology
◉ Which activity in the Ship (A5) phase of the security
development cycle sets requirements for quality gates that must
be met before release?
Answer: A5 policy compliance analysis
◉ Which post-release support activity should be completed when
companies are joining together?
Answer: Security architectural reviews
