D487 exam with complete solutions 2024

What is a study of real-world software security initiatives organized so companies can measure their initiatives and understand how to evolve them over time? - ANSWER-Building Security In Maturity Model (BSIMM) Which secure coding best practice says to use parameterized queries, encrypted connection strings stored in separate configuration files, and strong passwords or multi-factor authentication? - ANSWER-Database security The software security team is currently working to identify approaches for input validation, authentication, authorization, and configuration management of a new software product so they can deliver a security profile. Which threat modeling step is being described? - ANSWER-Analyzing the target Team members are being introduced during sprint zero in the project kickoff meeting. The person being introduced is a member of the scrum team, responsible for writing feature logic and attending sprint ceremonies. Which role is the team member playing? - ANSWER-Software developer Which mitigation technique can be used to fight against a data tampering threat? - ANSWER-Digital signatures What is a countermeasure to the web application security frame (ASF) configuration management threat category? - ANSWER-Service accounts have no administration capabilities. Which type of requirement specifies that credit card numbers displayed in the application will be masked so they only show the last four digits? - ANSWER-Privacy requirement Which type of requirement specifies that credit card numbers are designated as highly sensitive confidential personal information? - ANSWER-Data classification requirement Which architecture deliverable identifies whether the product adheres to organization security rules? - ANSWER-Policy compliance analysis The project team received a SonarQube report of their most recent stage deployment that contains 15 vulnerabilities that must be fixed before the product may be released to production. Which security testing technique is being used? - ANSWER-Source-code analysis Organizational leadership is considering buying a competitor and has asked the software security team to develop a plan to ensure the competitor's point-of-sale system complies with organizational policies. Which post-release deliverable is being described? - ANSWER-Security strategy for M&A products After determining a reported vulnerability was a credible claim, the product security incident response team (PSIRT) worked with development teams to create and test a patch. The patch is scheduled to be released at the end of the month. What is the response team's next step? - ANSWER-Notify customers that the fix is available The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one-time requirements, bucket requirements, and final security review requirements. Which type of requirement states that all user input values must be validated by type, size, and range? - ANSWER-Every-sprint requirement The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing security testing results from recently completed initiatives. Which BSIMM domain is being assessed? - ANSWER-Software security development life cycle (SSDL) touchpoints The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one-time requirements, bucket requirements, and final security review requirements. Which type of requirement states that the team must perform remote procedure call (RPC) fuzz testing? - ANSWER-Bucket requirement