Chapter 6

What is the main difference between the traditional SDLC and Secure Software Development Lifecycle (SSDLC)?

• SSDLC focuses on security throughout all development stages, whereas traditional SDLC emphasizes functionality

• Traditional SDLC integrates security from the beginning, while SSDLC does not

• SSDLC does not require security reviews and testing

• Traditional SDLC uses security automation tools, whereas SSDLC does not

What is the primary reason for integrating Patch Management into the Software Development Lifecycle (SDLC)?

• To keep software aesthetically appealing for users

• To ensure that software remains functional, secure, and reliable over time

• To introduce frequent software changes, regardless of security risks

• To eliminate all future security vulnerabilities permanently

What is a significant risk of failing to implement timely patching in software security?

• Increased software performance issues due to unnecessary updates

• Higher costs in maintaining software without patches

• Vulnerabilities remaining unaddressed, allowing attackers to exploit them

• Delays in the software development lifecycle due to unnecessary security audits

Why is it important to use a dedicated testing environment when assessing security patches?

• To increase deployment speed by testing directly in the production environment

• To prevent unintended disruptions to production systems while verifying patch functionality

• To allow security patches to be rolled out gradually over time without testing

• To ensure only major patches are tested, while minor patches are automatically deployed

Why is client-side input validation not enough for security?

• It ensures all data is formatted correctly before reaching the server

• Attackers can easily bypass client-side validation, making server-side validation essential

• Client-side validation is always performed automatically by modern browsers

• It prevents injection attacks without the need for additional security measures

What is a major risk of improper error handling?

• It can disclose sensitive internal information to attackers

• It slows down system performance

• It causes security patches to fail

• It makes software harder to debug for developers

What is the key difference between logging and monitoring?

• Logging captures real-time threats, while monitoring analyzes past logs

• Monitoring provides real-time insight, while logging records past actions

• Logging is only used for compliance, while monitoring is used for security

• Monitoring replaces the need for logging in modern security systems

Which of the following best describes the primary objective of threat modeling in the context of system development?

• To optimize the performance of applications and systems

• To identify and prioritize potential threats and vulnerabilities to safeguard assets

• To evaluate the financial impact of implementing security measures

• To ensure that all components of the system are documented

Which of the following best describes the concept of an attack surface?

• The number of attack vectors that have been blocked

• The total sum of potential vulnerabilities that can be exploited in a cybersecurity attack

• The specific type of software vulnerabilities in a given network

• The physical perimeter of a secure system

During the __________ stage, software developers and testers need to be informed about security issues and trained on how to address them.

• planning
• monitoring

• designing

• maintenance