CCNA Secure Software Lifecycle Management Questions

MCQeasy

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

A.System Architecture Diagram.

B.Software Security Policy (SSP).

C.Individual Sprint Backlog.

D.Developer Coding Standards.

AnswerB

This is the governance-level document that sets expectations.

Why this answer

A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Practice this question →

Multi-Selecthard

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

Select 2 answers

A.Increasing the frequency of manual code uploads.

B.Digitally signing code commits and build artifacts.

C.Conducting Software Composition Analysis (SCA) on dependencies.

D.Using only open-source libraries without vetting.

E.Ensuring all developers have root access to production.

AnswersB, C

Signing provides non-repudiation and integrity verification.

Why this answer

Code signing and dependency analysis are essential for verifying the source of code and the security of imported libraries.

Practice this question →

MCQmedium

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

A.Verification phase.

B.Design phase.

C.Implementation phase.

D.Requirements phase.

AnswerB

This is the standard phase for formal architectural and design security reviews.

Why this answer

The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Practice this question →

Multi-Selecthard

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

Select 2 answers

A.Limiting access to all security documentation.

B.Integrating security risk management with enterprise risk management.

C.Securing executive sponsorship and support.

D.Focusing exclusively on technical tool implementation.

E.Increasing the number of security alerts for developers.

AnswersB, C

Security must align with business risk appetite to be effective.

Why this answer

Executive sponsorship and integration with business risk management are vital for security to be a strategic rather than peripheral activity.

Practice this question →

Multi-Selectmedium

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

Select 3 answers

A.Integrating security unit tests into the automated test suite.

B.Performing manual penetration tests on every commit.

C.Waiting for the final release to review security documentation.

D.Conducting regular threat modeling sessions.

E.Incorporating security requirements into user stories.

AnswersA, D, E

Automated tests provide fast, continuous security feedback.

Why this answer

Automated testing, threat modeling sessions, and security-focused user stories all support high-velocity security integration.

Practice this question →

MCQeasy

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

A.To calculate the financial loss of the incident.

B.To satisfy external auditors' compliance requirements.

C.To update the SDLC to prevent similar future vulnerabilities.

D.To assign blame to the developer who wrote the code.

AnswerC

This is the core objective of post-incident analysis for lifecycle management.

Why this answer

Lessons learned help update the security lifecycle process to prevent similar future incidents, fostering continuous improvement.

Practice this question →

MCQmedium

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

A.Adding security-focused acceptance criteria to the Definition of Done.

B.Automating the deployment pipeline to run security scans only after the production release.

C.Performing a full threat model for every user story.

D.Conducting a penetration test at the end of every sprint.

AnswerA

This ensures security validation is a mandatory part of the development workflow.

Why this answer

Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Practice this question →

MCQmedium

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

A.Enabling 'Secret scanning' and 'Push protection' in the repository settings.

B.Writing a custom shell script to grep all files for common regex patterns.

C.Relying on developers to manually check for secrets before every push.

D.Configuring an external firewall to block all traffic containing API keys.

AnswerA

These features specifically identify and block secrets in real-time.

Why this answer

The 'secret scanning' feature in GitHub automatically detects patterns associated with secrets and prevents them from being pushed or alerts the user if they are committed.

Practice this question →

MCQmedium

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

A.Governance.

B.Implementation.

C.Verification.

D.Operations.

AnswerA

Governance defines the security activities integrated into the management lifecycle.

Why this answer

The 'Governance' business function in SAMM includes the 'Strategy & Metrics', 'Policy & Compliance', and 'Education & Guidance' practices, which focus on SDLC integration.

Practice this question →

MCQeasy

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

A.Project Manager.

B.Software Tester.

C.Security Architect.

D.Database Administrator.

AnswerC

This role translates security requirements into technical architecture.

Why this answer

The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Practice this question →

MCQhard

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

A.Implementing automated DAST tools.

B.Deploying a Web Application Firewall (WAF) to protect the current environment.

C.Performing a manual code review on all legacy source code.

D.Defining security requirements during the initial project planning/requirements phase.

AnswerD

Requirement phase is the earliest point to integrate security, providing the highest return on investment.

Why this answer

Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Practice this question →

Multi-Selecteasy

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

Select 3 answers

A.The speed of software development is too slow.

B.Lack of security expertise within development teams.

C.Difficulty integrating security tools into existing CI/CD pipelines.

D.Resistance to cultural and process changes.

E.Having too much budget for security tools.

AnswersB, C, D

Developers often need training to understand security concepts.

Why this answer

Resistance to change, tool integration difficulties, and lack of security expertise are frequently cited challenges.

Practice this question →

MCQhard

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

A.Storing artifacts in a public S3 bucket for easy access.

B.Deleting build artifacts immediately after the deployment to production.

C.Uploading artifacts to a shared developer network drive.

D.Using digital signatures to verify artifact integrity before deployment.

AnswerD

Signing provides cryptographic proof of the artifact's origin and integrity.

Why this answer

Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Practice this question →

MCQhard

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

A.Using default security settings provided by the cloud provider.

B.Implementing Infrastructure as Code (IaC) and scanning templates.

C.Relying on manual cloud console configuration.

D.Performing monthly manual audits of cloud resources.

AnswerB

IaC facilitates 'Policy as Code' and automated configuration validation.

Why this answer

Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Practice this question →

MCQhard

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

A.To act as a security advocate and bridge between security and dev teams.

B.To perform all manual code reviews for the entire department.

C.To handle all incident responses for the organization.

D.To replace the need for professional security audits.

AnswerA

This role bridges the gap and integrates security into daily development.

Why this answer

Security Champions act as liaisons between security teams and development teams, providing localized expertise and fostering a security culture within the team.

Practice this question →

Multi-Selectmedium

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Select 3 answers

A.Requiring developers to use only one specific programming language.

B.Providing secure coding training to developers.

C.Conducting periodic risk assessments of applications.

D.Buying insurance for all cyber incidents.

E.Defining requirements for audit logging and monitoring.

AnswersB, C, E

Training is a proactive measure for lifecycle management.

Why this answer

Risk assessment, secure coding training, and audit logging requirements are all essential management activities in the SDLC.

Practice this question →

Multi-Selecthard

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

Select 3 answers

A.Integrating security linting into the IDE.

B.Performing security design reviews before coding begins.

C.Conducting post-deployment vulnerability scanning.

D.Conducting static analysis (SAST) during the development phase.

E.Relying solely on external bug bounty programs.

AnswersA, B, D

IDE plugins provide the fastest feedback for developers.

Why this answer

Static analysis, secure design reviews, and IDE-integrated tools all move security activities earlier into the developer workflow.

Practice this question →

MCQmedium

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

A.Elevation of Privilege.

B.Tampering.

C.Information Disclosure.

D.Spoofing.

AnswerC

Information Disclosure occurs when unauthorized parties gain access to sensitive data.

Why this answer

STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Sniffing traffic is categorized as Information Disclosure.

Practice this question →

MCQmedium

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

A.Total number of lines of code written.

B.Number of developers on the team.

C.Mean Time to Remediate (MTTR) for vulnerabilities.

D.Budget allocated to security tools.

AnswerC

This is a key performance indicator for security lifecycle management.

Why this answer

Mean Time to Remediate (MTTR) tracks how quickly security vulnerabilities are addressed, reflecting both the efficiency of the remediation process and the maturity of the security program.

Practice this question →

Multi-Selectmedium

Which TWO of the following practices are key components of a robust Software Security Governance framework?

Select 2 answers

A.Outsourcing all security tasks to third-party vendors.

B.Mandating that all developers become certified hackers.

C.Discontinuing all legacy applications.

D.Establishing and tracking security performance metrics.

E.Defining clear security policies and standards.

AnswersD, E

Metrics ensure that the governance program is effective and improving.

Why this answer

Policy definition and measurable security metrics are foundational for governing software security activities.

Practice this question →

MCQmedium

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

A.Disable all rules except for critical-level vulnerabilities.

B.Perform incremental scans of the changed code.

C.Run full scans on every single commit.

D.Set the tool to break the build for every warning.

AnswerB

This minimizes latency and keeps feedback loops short.

Why this answer

Incremental scanning focuses on the changed code rather than the entire codebase, significantly reducing the scan time and the number of alerts presented to developers in every build.

Practice this question →

MCQeasy

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

A.To increase the speed of software compilation.

B.To automatically patch vulnerabilities in code.

C.To replace the need for secure coding training.

D.To maintain transparency of components and manage dependency risks.

AnswerD

This is the core objective of SBOMs for supply chain visibility.

Why this answer

An SBOM provides a comprehensive list of all third-party and open-source components, facilitating vulnerability management and supply chain security.

Practice this question →