NO.16 Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?

NO.17 The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?

NO.18 What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category?

NO.19 Company leadership has contracted with a security firm to evaluate the vulnerabilityofall externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?

NO.20 Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only those needed for the business purpose?

NO.21 The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?

NO.22 What is a countermeasure to the web application security frame (ASF) authentication threat category?

NO.23 The software security team is using an automation tool that generates random data to input into every field in the new product and track results.
Which security testing technique is being used?

NO.24 What is an advantage of using the Agile development methodology?

NO.25 The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations.
Which activity of the Ship SDL phase is being performed?

NO.26 The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies.
Which post-release deliverable is being described?

NO.27 The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?

NO.28 Which question reflects the security change management component of the change management process?

NO.29 Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?

NO.30 The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure.
Which security testing technique is being used?

NO.31 During fuzz testing of the new product, an exception was thrown on the order entry view, which caused a full stack dump to be displayed in the browser window that included function names from the source code.
How should existing security controls be adjusted to prevent this in the future?

NO.32 The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team’s quality standards.
Which category of secure software best practices is the team performing?

NO.33 Which category classifies identified threats that have defenses in place and do not expose the application to exploits?

NO.34 Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?

NO.35 Which mitigation technique can be used to light against a threat where a user may gain access to administrator level functionality?

NO.36 A potential threat was discovered during automated system testing when a PATCH request sent to the API caused an unhandled server exception. The API only supports GET. POST. PUT,and DELETE requests.
How should existing security controls be adjusted to prevent this in the future?

NO.37 Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?