Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 8.1: Security in SDLC methodologies, maturity models, operations/maintenance, change management, and integrated product teams
A product team repeatedly discovers privacy and access-control defects during preproduction testing, causing expensive redesign. Which change would BEST reduce recurrence?
- A.Add more penetration testers only after coding is complete
- B.Define testable security and privacy requirements with misuse cases during product planning and trace them through delivery
- C.Move every defect to the next release
- D.Let each developer choose whether security applies to a feature
Show answer and explanation
Best answer: B. Define testable security and privacy requirements with misuse cases during product planning and trace them through delivery
Early, testable requirements and misuse cases guide design and provide traceability into implementation and verification, reducing late rework.
A: Late testing detects defects after costly design decisions.
B: Early, testable requirements and misuse cases guide design and provide traceability into implementation and verification, reducing late rework.
C: Deferral accepts recurrence and accumulating risk.
D: Optional individual judgment does not produce consistent requirements.
Question 2·Objective 8.2: Controls in languages, libraries, tools, IDEs, runtimes, CI/CD, configuration management, repositories, SAST, DAST, SCA, and IAST
A critical vulnerability is discovered in an open-source library after several applications using it are already in production. Leadership wants a control that will reduce both future deployment of known-vulnerable components and the time needed to locate newly affected applications. Which solution BEST meets both goals?
- A.Ban all open-source components from future development
- B.Run annual penetration tests against every production application
- C.Integrate software composition analysis into CI/CD and maintain an inventory of deployed component versions
- D.Require developers to subscribe individually to vulnerability mailing lists
Show answer and explanation
Best answer: C. Integrate software composition analysis into CI/CD and maintain an inventory of deployed component versions
SCA in the delivery pipeline can detect known-vulnerable dependencies before release, while an accurate deployed-component inventory supports rapid impact analysis when a vulnerability is disclosed later. The combination addresses prevention and traceability.
A: A blanket ban is disproportionate and does not address third-party components already deployed or supplied commercially.
B: Periodic penetration testing may identify exploitable behavior but is too infrequent and does not reliably inventory dependency versions.
C: SCA in the delivery pipeline can detect known-vulnerable dependencies before release, while an accurate deployed-component inventory supports rapid impact analysis when a vulnerability is disclosed later. The combination addresses prevention and traceability.
D: Individual subscriptions are inconsistent, difficult to verify, and do not provide centralized deployment gates or asset traceability.
Question 3·Objective 8.3: Auditing/logging changes and software risk analysis/mitigation
An unauthorized production code change is discovered, but the repository history can be rewritten by the same administrators who deploy releases. Which improvement BEST strengthens accountability?
- A.Store signed build and deployment events in a separately controlled, append-resistant audit system
- B.Allow more administrators to rewrite repository history
- C.Record deployment details only in developer chat
- D.Disable logging to prevent sensitive code from appearing in records
Show answer and explanation
Best answer: A. Store signed build and deployment events in a separately controlled, append-resistant audit system
Separately controlled, tamper-evident records of signed build and deployment events reduce the ability of one privileged path to alter both production and its audit trail.
A: Separately controlled, tamper-evident records of signed build and deployment events reduce the ability of one privileged path to alter both production and its audit trail.
B: More rewrite privileges weaken accountability.
C: Chat is not a controlled, complete deployment audit trail.
D: Removing logs eliminates evidence rather than protecting it.
Question 4·Objective 8.5: Source-level weaknesses, API security, secure coding, and software-defined security
A web application builds database queries by concatenating a user-supplied account identifier into SQL. Which remediation MOST directly prevents the identifier from changing the query's intended structure?
- A.Validate expected input and use parameterized queries with bound variables
- B.Hide database errors while continuing string concatenation
- C.Encrypt the web server's storage volume
- D.Require users to change passwords more frequently
Show answer and explanation
Best answer: A. Validate expected input and use parameterized queries with bound variables
Server-side validation constrains accepted data, while parameter binding separates data from SQL instructions and directly prevents structural injection through the identifier.
A: Server-side validation constrains accepted data, while parameter binding separates data from SQL instructions and directly prevents structural injection through the identifier.
B: Error suppression may reduce disclosure but does not remove injection.
C: Disk encryption does not change unsafe query construction during execution.
D: Password rotation is unrelated to SQL parsing.
Question 5·Objective 8.1: Security in SDLC methodologies, maturity models, operations/maintenance, change management, and integrated product teams
A team has approved security requirements but cannot show which design components and tests implement them. What practice BEST closes this assurance gap?
- A.Rely on a final penetration test without relating findings to requirements
- B.Let individual developers decide which requirements deserve tests
- C.Maintain bidirectional traceability from each security requirement through design, implementation, and verification evidence
- D.Document requirements only after the release is deployed
Show answer and explanation
Best answer: C. Maintain bidirectional traceability from each security requirement through design, implementation, and verification evidence
This is the best control because it directly addresses the stated security objective with an enforceable design decision.
A: This is weaker because it does not provide the necessary preventive control for the stated scenario.
B: This is weaker because it does not provide the necessary preventive control for the stated scenario.
C: This is the best control because it directly addresses the stated security objective with an enforceable design decision.
D: This is weaker because it does not provide the necessary preventive control for the stated scenario.
Question 6·Objective 8.2: Controls in languages, libraries, tools, IDEs, runtimes, CI/CD, configuration management, repositories, SAST, DAST, SCA, and IAST
A CI pipeline downloads dependencies by mutable package names. What is the BEST improvement?
- A.Disable dependency scanning
- B.Always select the newest unverified build
- C.Store build credentials in source code
- D.Pin verified versions and validate provenance and integrity
Show answer and explanation
Best answer: D. Pin verified versions and validate provenance and integrity
Version pinning and provenance checks reduce dependency substitution and drift.
A: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
B: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
C: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
D: Version pinning and provenance checks reduce dependency substitution and drift.
Question 7·Objective 8.3: Auditing/logging changes and software risk analysis/mitigation
A threat model identifies abuse of a password-reset workflow. What should the team create?
- A.Misuse cases and security tests covering the abuse path
- B.Functional tests limited to successful authorized resets
- C.Performance tests for peak reset-request volume
- D.Recovery documentation for the credential database
Show answer and explanation
Best answer: A. Misuse cases and security tests covering the abuse path
Misuse cases translate identified threats into verifiable behavior and controls.
A: Misuse cases translate identified threats into verifiable behavior and controls.
B: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
C: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
D: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
Question 8·Objective 8.4: Risk from COTS, open-source, third-party, managed, and cloud software/services
A production defect exposes session tokens. What should happen FIRST?
- A.Wait for the next release train
- B.Contain exposure, revoke affected tokens, and activate incident handling
- C.Remove the defect from the tracker
- D.Notify users before validating scope or containment
Show answer and explanation
Best answer: B. Contain exposure, revoke affected tokens, and activate incident handling
Containment and credential invalidation reduce ongoing harm while investigation proceeds.
A: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
B: Containment and credential invalidation reduce ongoing harm while investigation proceeds.
C: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
D: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
Question 9·Objective 8.5: Source-level weaknesses, API security, secure coding, and software-defined security
A company buys a commercial library for a safety-critical application. What is MOST important?
- A.Assume commercial code is defect-free
- B.Skip integration testing
- C.Evaluate supplier assurance, component risk, support, and contractual security requirements
- D.Accept unlimited supplier access
Show answer and explanation
Best answer: C. Evaluate supplier assurance, component risk, support, and contractual security requirements
Acquired software still requires risk-based assurance and lifecycle governance.
A: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
B: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
C: Acquired software still requires risk-based assurance and lifecycle governance.
D: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
Question 10·Objective 8.1: Security in SDLC methodologies, maturity models, operations/maintenance, change management, and integrated product teams
Product owners cannot determine whether a security story is complete. What should be added?
- A.More ambiguous wording
- B.A general promise to be secure
- C.An unrelated performance target
- D.Objective acceptance criteria tied to the security requirement
Show answer and explanation
Best answer: D. Objective acceptance criteria tied to the security requirement
Measurable acceptance criteria make security work testable and auditable.
A: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
B: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
C: This option may have a limited role, but it does not provide the control or assurance required by the stated conditions.
D: Measurable acceptance criteria make security work testable and auditable.
Continue studying Software Development Security
Review the complete Domain 8 guide, then mix this material with the other seven domains in an adaptive mock exam.