Q36. Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?

Q37. Company leadership has discovered an untapped revenue stream within its customer base and wants to meet with IT to share its vision for the future and determine whether to move forward.
Which phase of the software development lifecycle (SDLC) is being described?

Q38. Which design and development deliverable contains the types of evaluations that were performed, how many times they were performed, and how many times they were re-evaluated?

Q39. A product team, consisting of a Scrum Master, a Business Analyst, two Developers, and a Quality Assurance Tester, are on a video call with the Product Owner. The team is reviewing a list of work items to determine how many they feel can be added to their backlog and completed within the next two-week iteration.
Which Scrum ceremony is the team participating in?

Q40. Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?

Q41. Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?

Q42. Which concept is demonstrated when every module in a particular abstraction layer of a computing environment can only access the information and resources that are necessary for its legitimate purpose?

Q43. What is an advantage of using the Agile development methodology?

Q44. Which question reflects the security change management component of the change management process?

Q45. The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?

Q46. Which security assessment deliverable identities possible security vulnerabilities in the product?

Q47. What sitsbetween a browser and an internet connection and alters requests and responses in a way thedeveloper did not intend?

Q48. Recent vulnerability scans discovered that the organization’s production web servers were responding to ping requests with server type, version, and operating system, which hackers could leverage to plan attacks.
How should the organization remediate this vulnerability?

Q49. Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?

Q50. What is a countermeasure to the web application security frame (ASF) authentication threat category?

Q51. A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?

Q52. Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?

Q53. The security team is identifying technical resources that will be needed to perform the final product security review.
Which step of the final product security review process are they in?

Q54. Using a web-based common vulnerabilityscoringsystem (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company’s claims intake component.The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal andenvironmental metrics.
Which rating would CVSS assign this vulnerability?

Q55. Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?

Q56. A software security team recently completed an internal assessment of the company’s security assurance program. The team delivered a set of scorecards to leadership along with proposed changes designed to improve low-scoring governance, development, and deployment functions.
Which software security maturity model did the team use?

Q57. Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?

Q58. The software security team is performing security testing on a new software product using a testing tool that scans the running application for known exploit signatures.
Which security testing technique is being used?

Q59. Which type of security analysis is performed by reviewing source code line-by-line after other security analysis techniques have been executed?

Q60. During fuzz testing of the new product, an exception was thrown on the order entry view, which caused a full stack dump to be displayed in the browser window that included function names from the source code.
How should existing security controls be adjusted to prevent this in the future?