Secure Software Lifecycle Management

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

Which TWO of the following practices are key components of a robust Software Security Governance framework?

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?