Secure Software Lifecycle Management

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Which TWO of the following practices are key components of a robust Software Security Governance framework?

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?