Question 1

Which secure coding best practice says to assume all incoming data should be considered untrusted and should be validated to ensure the system only accepts valid data?

Options :

A : General coding practices

B : Input validation

C : Session management

D : System configuration

Answer: B

Question 2

Which threat modeling step collects exploitable weaknesses within the product?

Options :

A : Analyze the target

B : Rate threats

C : Identify and document threats

D : Set the scope

Answer: C

Question 3

Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?

Options :

A : Fuzz testing

B : Dynamic code analysis

C : Manual code review

D : Static code analysis

Answer: C

Question 4

Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?

Options :

A : Personal information retention requirements

B : User controls requirements

C : Third party requirements

D : Data integrity requirements

Answer: C

Question 5

A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?

Options :

A : Access control

B : Data protection

C : Input validation

D : Authentication

Answer: A

Higher Test Marks with Free Online Secure-Software-Design Exam Practice

Buying Options: