本日更新されたSecure-Software-Design練習テスト2026年最新の無料問題集を無料登録！
最新のFast2test Secure-Software-DesignのPDF問題集をダウンロード（118問題と解答)
質問 # 68
Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized?
- A. Authentication and Password Management
- B. Error Handling and Logging
- C. System Configuration
- D. Input Validation
正解：B
質問 # 69
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:
Which technique should be used to detect this vulnerability without running the source codes?
- A. Fuzz testing
- B. Cross-site scripting
- C. Dynamic analysis
- D. Static analysis
正解：D
解説：
Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code's structure, syntax, and data flow.
References:
* Static analysis as a means to identify security vulnerabilities1.
* The importance of static analysis in the early stages of the SDLC to prevent security issues2.
* Learning-based approaches to fix SQL injection vulnerabilities using static analysis3.
質問 # 70
What are the eight phases of the software development lifecycle (SDLC)?
- A. Plan, gather requirements, identify attack surface, design, write code, perform code reviews, test, deploy
- B. Gather requirements, prototype, perform threat modeling, write code, test, user acceptance testing, deploy, maintain
- C. Planning, requirements, design, implementation, testing, deployment, maintenance, end of life
- D. Planning, security analysis, requirement analysis, design, implementation, threat mitigation, testing, maintenance
正解：C
質問 # 71
A security architect is creating a data flow diagram and draws an arrow between two circles.
What does the arrow represent?
- A. External Entity
- B. Process
- C. Data Store
- D. Data Flow
正解：D
質問 # 72
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Information disclosure
- B. Spoofing
- C. Elevation of privilege
- D. Tampering
正解：D
解説：
The type of threat described is Tampering. This threat occurs when an attacker intercepts and manipulates data being sent from the client to the server, such as formdata being submitted to an API. The attacker may alter the data to change the intended operation, inject malicious content, or compromise the integrity of the system. Tampering attacks are a significant concern in secure software design because they can lead to unauthorized changes and potentially harmful actions within the application.
References:
* Understanding the different types of API attacks and their prevention1.
* Comprehensive guide on API security and threat mitigation2.
* Detailed analysis of Man-in-the-Middle (MitM) attacks and their impact on API security3.
質問 # 73
While performing functional testing of the new product from a shared machine, a QA analyst closed their browser window but did not logout of the application. A different QA analyst accessed the application an hour later and was not prompted to login. They then noticed the previous analyst was still logged into the application.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure no sensitive information is stored in plain text in cookies
- B. Ensure role-based access control is enforced for access to all resources
- C. Ensure strong password policies are enforced
- D. Ensure user sessions timeout after short intervals
正解：D
解説：
The issue described involves a session management vulnerability where the user's session remains active even after the browser window is closed, allowing another user on the same machine to access the application without logging in. To prevent this security risk, it's essential to adjust the session management controls to include an automatic timeout feature. This means that after a period of inactivity, or when the browser window is closed, the session should automatically expire, requiring a new login to access the application.
This adjustment ensures that even if a user forgets to log out, their session won't remain active indefinitely, reducing the risk of unauthorized access.
:
Secure SDLC practices emphasize the importance of security at every stage of the software development life cycle, including the implementation of proper session management controls12.
Best practices for access control in security highlight the significance of managing session timeouts to prevent unauthorized access3.
Industry standards and guidelines often recommend session timeouts as a critical security control to protect against unauthorized access4.
質問 # 74
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?
- A. Dynamic analysis
- B. Static analysis
- C. Manual code review
- D. Fuzz testing
正解：A
解説：
Dynamic analysis is a security testing method that involves analyzing the behavior of software while it is running or in execution. It is most commonly executed during the testing phase of the Software Development Life Cycle (SDLC). This type of analysis is used to detect issues that might not be visible in the code's static state, such as runtime errors and memory leaks. Automated tools are employed to perform dynamic analysis, which can simulate attacks on the application and identify vulnerabilities that could be exploited by malicious actors.
: The information provided here is verified by multiple sources that discuss security automation in the SDLC and the role of dynamic analysis during the testing phase123.
質問 # 75
Which threat modeling step collects exploitable weaknesses within the product?
- A. Analyze the target
- B. Rate threats
- C. Set the scope
- D. Identify and document threats
正解：D
解説：
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
質問 # 76
Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?
- A. Black box testing
- B. Dynamic testing
- C. Reasonableness testing
- D. White box testing
正解：D
解説：
White box testing, also known as clear box testing, glass box testing, transparent box testing, and structural testing, is a method of software testing where the internal structure, design, and coding of the software are tested to verify the flow of input-output and to improve the design, usability, and security. It involves looking at the structures that are internal to the system, with the tester having knowledge of the internal workings of the product. This type of testing is concerned with examining the internal logical structures of the program and is typically performed by stepping through the code line by line to analyze the program for potential errors, which aligns with the description of the control test in question.
References:
* Control Structure Testing - GeeksforGeeks1
* What is White Box Testing? - BrowserStack2
* Software Testing Strategies Chapter 18 - IIT3
質問 # 77
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?
- A. Governance
- B. Deployment
- C. Software security development life cycle (SSDL) touchpoints
- D. Intelligence
正解：D
解説：
The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization's ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.
References: The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework12345.
質問 # 78
Which design and development deliverable contains the results of each type of evaluation that was performed and the type and number of vulnerabilities discovered?
- A. Security testing reports
- B. Security test execution report
- C. Privacy compliance report
- D. Remediation report
正解：A
解説：
Security testing reports are the deliverables that typically contain detailed results of the security evaluations performed. These reports include the types of tests conducted, such as static and dynamic analysis, penetration testing, and code reviews, as well as the number and types of vulnerabilities discovered. The purpose of these reports is to document the security posture of the software at the time of testing and to provide a basis for remediation efforts.
: The information aligns with best practices in secure software development, which emphasize the importance of documenting security requirements and conducting risk analysis during the design phase to identify and mitigate vulnerabilities early in the SDLC12.
質問 # 79
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Information disclosure
- B. Spoofing
- C. Elevation of privilege
- D. Tampering
正解：D
質問 # 80
What is a countermeasure to the web application security frame (ASF) authentication threat category?
- A. Role-based access controls restrict access
- B. Credentials and tokens are encrypted.
- C. Cookies have expiration timestamps.
- D. Sensitive information is scrubbed from error messages
正解：A
解説：
* ASF Authentication Threats: The Web Application Security Frame (ASF) authentication category encompasses threats related to how users and systems prove their identity to the application. This includes issues like weak passwords, compromised credentials, and inadequate access controls.
* Role-Based Access Control (RBAC): RBAC is a well-established security principle that aligns closely with addressing authentication threats. It involves assigning users to roles and granting those roles specific permissions based on the principle of least privilege. This limits the attack surface and reduces the impact of a compromised user account.
Let's analyze the other options:
* B. Credentials and tokens are encrypted: While vital for security, encryption primarily protects data at rest or in transit. It doesn't directly address authentication risks like brute-force attacks or weak password management.
* C. Cookies have expiration timestamps: Expiring cookies are a good practice, but their primary benefit is session management rather than directly mitigating authentication-specific threats.
* D. Sensitive information is scrubbed from error messages: While essential for preventing information leakage, this practice doesn't address the core threats within the ASF authentication category.
References:
* NIST Special Publication 800-53 Revision 4, Access Control (AC)
Family: (https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final) Details the importance of RBAC as a cornerstone of access control.
* The Web Application Security Frame (ASF): (https://patents.google.com/patent/US7818788B2/en) Outlines the ASF categories, with authentication being one of the primary areas.
質問 # 81
The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP SAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?
- A. Construction
- B. Governance
- C. Deployment
- D. Verification
正解：D
解説：
Comprehensive and Detailed In-Depth Explanation:
The Open Web Application Security Project (OWASP) Software Assurance Maturity Model (SAMM) is a framework designed to help organizations assess and improve their software security posture. SAMM is structured around five primary business functions: Governance, Design, Implementation, Verification, and Operations.
In this scenario, the focus is on reviewing design artifacts to ensure compliance with organizational security standards. This activity aligns with the Verification business function within SAMM. The Verification function encompasses security practices related to assessing and validating the security of software artifacts throughout the development lifecycle. Key practices under this function include:
* Design Review: Evaluating design documents and models to identify potential security issues and ensure that security requirements are adequately addressed.
* Code Review: Analyzing source code to detect security vulnerabilities and ensure adherence to secure coding standards.
* Security Testing: Conducting various testing methodologies, such as penetration testing and vulnerability scanning, to identify and remediate security weaknesses in the software.
By focusing on the Verification function, the organization aims to proactively identify and address security concerns during the design and development phases, thereby enhancing the overall security posture of their software products.
References:
* OWASP SAMM - Verification
質問 # 82
The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.
Which security testing technique is being used?
- A. Binary fault injection
- B. Dynamic code analysis
- C. Fuzz testing
- D. Binary code analysis
正解：C
解説：
Fuzz testing is the ideal technique in this scenario. Here's why:
* Focus on Integrations: The scenario emphasizes testing links between the software, databases, web servers, and web services. Fuzz testing is specifically designed to find vulnerabilities in how software handles data and communication between components.
* Pre-release Testing: The product being close to release indicates a critical need to identify security flaws before public deployment. Fuzz testing is effective in uncovering unexpected behavior and potential vulnerabilities.
* Fuzz Testing Targets: Fuzz testing works by injecting invalid or unexpected data into interfaces (like those between databases, web components, etc.) to observe how the software reacts. This helps expose potential security gaps and weaknesses.
質問 # 83
Which concept is demonstrated when every module in a particular abstraction layer of a computing environment can only access the information and resources that are necessary for its legitimate purpose?
- A. Confidentiality
- B. Elevation of Privilege
- C. Principle of Least Privilege
- D. Privacy
正解：C
質問 # 84
The Chief Information Security Officer (CISO) has recommended contracting with external experts to perform annual reviews of the enterprise's software products, including penetration testing.
Which post-release deliverable is being described?
- A. Third-Party Security Review
- B. Post-Release Certifications
- C. Security Strategy for Legacy Code
- D. External Vulnerability Disclosure Response Process
正解：A
質問 # 85
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?
- A. Governance
- B. Deployment
- C. Software security development life cycle (SSDL) touchpoints
- D. Intelligence
正解：D
解説：
The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization's ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.
References: The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework12345.
質問 # 86
Recent vulnerability scans discovered that the organization's production web servers were responding to ping requests with server type, version, and operating system, which hackers could leverage to plan attacks.
How should the organization remediate this vulnerability?
- A. Access to configuration files is limited to administrators
- B. Always uninstall or disable features that are not required
- C. Ensure servers are configured to return as little information as possible to network requests
- D. Ensure servers are regularly updated with the latest security patches
正解：C
解説：
To remediate the vulnerability of servers responding to ping requests with sensitive information, the organization should configure the servers to return as little information as possible to network requests. This practice is known as reducing the attack surface. By limiting the amount of information disclosed, potential attackers have less data to use when attempting to exploit vulnerabilities. Regular updates and patching (Option B) are also important, but they do not address the specific issue of information disclosure.
Uninstalling or disabling unnecessary features (Option C) and restricting access to configuration files (Option D) are good security practices, but they do not directly prevent the leakage of server information through ping responses.
: The remediation steps are aligned with best practices in vulnerability management, which include finding, prioritizing, and fixing vulnerabilities, as well as configuring servers to minimize the exposure of sensitive information123.
質問 # 87
The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies.
Which post-release deliverable is being described?
- A. Security strategy for legacy code
- B. Post-release certifications
- C. Security strategy tor M&A products
- D. External vulnerability disclosure response process
正解：A
解説：
The task described involves assessing a document management application that has been in use for many years. This scenario typically requires a security strategy that addresses the unique challenges of legacy code.
Legacy code refers to software that has been around for a long time and may not have been developed with current security standards in mind. A security strategy for legacy code would include measures to ensure that the application complies with current organizational policies, which may involve code reviews, updates, and the implementation of modern security practices to mitigate any potential vulnerabilities inherent in older code12.
References:
* Remotebase, "Best Practices for Managing Legacy Code"
* Medium, "The Engineer's Complete Guide to Legacy Code"
* Parasoft, "Testing Legacy Code & 3 Steps to Update"
質問 # 88
The product team has been tasked with updating the user interface (UI). They will change the layout and also add restrictions to field lengths and what data will be accepted.
Which secure coding practice is this?
- A. Data protection
- B. Access control
- C. Communication security
- D. Input validation
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
This is an example of Input validation, which involves ensuring all user inputs conform to expected formats, lengths, and content before processing. Restricting field lengths and validating accepted data types prevents injection attacks, buffer overflows, and improper data handling. Access control (B) restricts user permissions, communication security (C) protects data in transit, and data protection (D) focuses on confidentiality and integrity of stored data. OWASP Secure Coding Practices and Microsoft SDL emphasize rigorous input validation as a first line of defense against many vulnerabilities.
References:
OWASP Secure Coding Practices - Input Validation
Microsoft SDL Secure Coding Guidelines
NIST SP 800-53: Security and Privacy Controls for Information Systems
質問 # 89
Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure passwords are encrypted when stored in persistent data stores
- B. Ensure authentication controls are resistant to brute force attacks
- C. Ensure strong password policies are enforced
- D. Ensure credentials and authentication tokens are encrypted during transit
正解：B
質問 # 90
Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?
- A. Manual code review
- B. Dynamic code analysis
- C. Fuzz testing
- D. Static code analysis
正解：A
解説：
Manual code review is a type of security analysis that requires a significant time investment from a highly skilled team member. This process involves a detailed and thorough examination of the source code to identify security vulnerabilities that automated tools might miss. It is labor-intensive because it relies on the expertise of the reviewer to understand the context, logic, and potential security implications of the code. Unlike automated methods like static or dynamic code analysis, manual codereview demands a deep understanding of the codebase, which can be time-consuming and requires a high level of skill and experience.
References: The information provided here is based on industry best practices and standards for secure software design and development, as well as my understanding of security analysis methodologies12.
質問 # 91
......
2026年03月最新Secure-Software-Design試験問題集PDFと試験エンジン：https://jp.fast2test.com/Secure-Software-Design-premium-file.html
プレミアム良質なWGU Secure-Software-Designオンライン問題集：https://drive.google.com/open?id=1I2PUTvgyyb09kvUG7BP6yTw-MV5Vj3VH