Free WGU Secure-Software-Design Practice Exam with Questions & Answers

The phase being described is the Planning phase of the SDLC. This initial stage involves gathering business requirements and evaluating the feasibility of the project. It’s when the company leadership would typically meet with IT and other stakeholders to share visions for the future, discuss potential revenue streams, and determine the project’s direction before moving forward with development. This phase is crucial for setting the groundwork for all subsequent phases of the SDLC.

An intercept proxy, also known as a proxy server, sits between a web client (such as a browser) and an external server to filter, monitor, or manipulate the requests and responses passing through it. This can be used for legitimate purposes, such as security testing and user privacy, but it can also be exploited by attackers to alter web traffic in a way that the developer did not intend, potentially leading to security vulnerabilities.

The deliverable that would aid a software security team in preparing a detailed schedule mapping security development lifecycle phases to the type of analysis they will execute is Security test plans. These plans are crucial as they outline the testing strategies and specific security tests that will be conducted during the development lifecycle to ensure the software meets the required security standards.

Security test plans are developed after the requirements and design phases and are used throughout the implementation, verification, and release phases. They include detailed instructions for security testing, criteria for success, and the types of security testing to be performed, such as static and dynamic analysis, penetration testing, and code review.

These plans are living documents that should be updated as new threats are identified and as the project evolves. They ensure that all team members understand the security goals, the risks, and the measures that need to be taken to mitigate those risks.

By having a well-defined security test plan, the team can ensure that security is not an afterthought but is integrated into every phase of the software development lifecycle, thus producing more secure software.

 Session management is a core component of secure coding, which involves maintaining the state of a user’s interaction with a system. Proper session management can help protect against various security vulnerabilities, such as session hijacking and session fixation attacks. It is essential for ensuring that user data is handled securely throughout an application’s workflow.

Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code’s structure, syntax, and data flow.

Validating user input data before it is processed by the application is a fundamental security control in software design. This process, known as input validation, ensures that only properly formed data is entering the workflow of the application, thereby preventing many types of attacks, including type mismatches as mentioned in the question. By validating input data, the application can reject any requests that contain unexpected or malicious data, reducing the risk of security vulnerabilities and ensuring the integrity of the system.

The step of the PASTA threat modeling methodology where the team will capture infrastructure, application, and software dependencies is the Define technical scope step. This step involves detailing the technical elements of the project, which includes understanding and documenting the infrastructure, applications, and software dependencies that are critical to the system’s operation and security.

Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.