Secure Software Lifecycle Management

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

You are leading a secure software initiative at a mid-sized fintech company. The development teams have adopted an Agile methodology with two-week sprints, and management wants to ensure that security activities are integrated into the development process without slowing down delivery. Which of the following is the MOST effective approach to integrate security into the Agile lifecycle?

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

A software development team is adopting a Secure Software Lifecycle (S-SDLC) process. They have defined security requirements, performed threat modeling, and are now in the implementation phase. Which of the following activities is MOST critical during the implementation phase to ensure secure code?

You are the security lead for a healthcare software product that must comply with HIPAA. The organization is adopting a DevSecOps model and wants to ensure that security is measured and improved continuously. Which TWO of the following metrics are MOST appropriate for tracking the effectiveness of the secure software lifecycle management process? (Choose two.)

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

You are a security architect at a company that develops a widely used mobile banking application. The development team uses a third-party open-source library for encryption. A critical vulnerability is disclosed in that library. What is the MOST effective first step to manage this risk within the secure software lifecycle?

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Which TWO of the following practices are key components of a robust Software Security Governance framework?

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?