Q32. Developers have finished coding, and changes have been peer-reviewed. Features have been deployed to a pre- production environment so that analysts may verify that the product is working as expected.
Which phase of the Software Development Life Cycle (SDLC) is being described?

Q33. Which question reflects the security change management component of the change management process?

Q34. Which category classifies identified threats that have defenses in place and do not expose the application to exploits?

Q35. Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?

Q36. An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:

Which technique should be used to detect this vulnerability without running the source codes?

Q37. Credit card numbers are encrypted when stored in the database but are automatically decrypted when data is fetched. The testing tool intercepted the GET response, and testers were able to view credit card numbers as clear text.
How should the organization remediate this vulnerability?

Q38. In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?

Q39. Due to positive publicity from the release of the new software product, leadership has decided that it is in the best interests of the company to become ISO 27001 compliant. ISO 27001 is the leading international standard focused on information security.
Which security development life cycle deliverable is being described?

Q40. Which category classifies identified threats that do not have defenses in place and expose the application to exploits?

Q41. Features have been developed and fully tested, the production environment has been created, and leadership has approved the release of the new product. Technicians have scheduled a time and date to make the product available to customers.
Which phase of the software development lifecycle (SDLC) is being described?

Q42. Which secure software design principle states that it is always safer to require agreement of more than one entity to make a decision?

Q43. Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?

Q44. Company leadership has contracted with a security firm to evaluate the vulnerabilityofall externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?

Q45. After being notified of a vulnerability in the company’s online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab.
What is the response team’s next step?

Q46. The product team has been tasked with updating the user interface (UI). They will change the layout and also add restrictions to field lengths and what data will be accepted.
Which secure coding practice is this?

Q47. What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category?

Q48. The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?

Q49. A company is moving forward with a new product. Product scope has been determined, teams have formed, and backlogs have been created. Developers are actively writing code for the new product, with one team concentrating on delivering data via REST services, one Team working on the mobile apps, and a third team writing the web application.
Which phase of the software development lifecycle (SDLC) is being described?

Q50. Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?

Q51. Senior IT staff has determined that a new product will be hosted in the cloud and will support web and mobile users. Developers will need to deliver secure REST services. Android and IOS mobile apps. and a web application. Developers are currently determining how to deliver each part of the overall product.
Which phase of the software development lifecycle (SDLC) is being described?

Q52. The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure.
Which security testing technique is being used?