SSDLC Knowledge Check

1 point(s)

In the CIA Triad, what does the letter C stand for?

Confidentiality

Correct Incorrect Correct answer

Consistency

Correct Incorrect Correct answer

Compliance

Correct Incorrect Correct answer

Cryptography

Correct Incorrect Correct answer

1 point(s)

Which statement best describes the Principle of Least Privilege?

Topic: Key Security Principles.

Users and systems receive only the minimum access required for their role

Correct Incorrect Correct answer

All users receive administrator access to reduce support tickets

Correct Incorrect Correct answer

Access rights are granted permanently once approved

Correct Incorrect Correct answer

Only external users are restricted; internal users are trusted by default

Correct Incorrect Correct answer

1 point(s)

What is the primary purpose of a misuse case during requirements gathering?

Topic: Requirements Gathering.

To describe how an attacker might abuse the system, so defenses become requirements

Correct Incorrect Correct answer

To document features users dislike

Correct Incorrect Correct answer

To track bugs found during QA

Correct Incorrect Correct answer

To replace functional use cases entirely

Correct Incorrect Correct answer

1 point(s)

What is the correct order of the four threat modeling steps taught in this workshop?

Topic: Secure Design.

Identify assets, identify threats, analyze risk and impact, design mitigations

Correct Incorrect Correct answer

Design mitigations, identify assets, run scans, deploy

Correct Incorrect Correct answer

Identify threats, patch, monitor, report

Correct Incorrect Correct answer

Analyze risk, identify assets, accept risk, document

Correct Incorrect Correct answer

1 point(s)

Which technique prevents SQL injection?

Topic: Secure Development.

Parameterized queries that separate code from data

Correct Incorrect Correct answer

Concatenating user input into the SQL string after trimming spaces

Correct Incorrect Correct answer

Hiding database error messages from users

Correct Incorrect Correct answer

Renaming database tables to unpredictable names

Correct Incorrect Correct answer

1 point(s)

A page prints user input with echo $_GET[‘name’]. What is the correct fix against XSS?

Topic: Secure Development.

Encode the output, e.g. htmlspecialchars with ENT_QUOTES and UTF-8

Correct Incorrect Correct answer

Block the letters 'script' from all input

Correct Incorrect Correct answer

Move the page to HTTPS

Correct Incorrect Correct answer

Store the input in a database before printing it

Correct Incorrect Correct answer

1 point(s)

What is the key difference between SAST and DAST?

Topic: Secure Testing.

SAST analyzes code without executing it; DAST tests the running application

Correct Incorrect Correct answer

SAST is manual; DAST is automated

Correct Incorrect Correct answer

SAST is for mobile apps; DAST is for web apps

Correct Incorrect Correct answer

DAST runs before code review; SAST runs in production only

Correct Incorrect Correct answer

1 point(s)

Which mechanism protects a form against Cross-Site Request Forgery (CSRF)?

Topic: Secure Development.

A hidden, unpredictable token validated on the server with each submission

Correct Incorrect Correct answer

A CAPTCHA on the login page only

Correct Incorrect Correct answer

Client-side JavaScript validation of all fields

Correct Incorrect Correct answer

Limiting the form to POST requests

Correct Incorrect Correct answer

1 point(s)

In C, strcpy(buffer, userInput) into a 10-byte buffer is dangerous because…

Topic: Secure Development.

It copies without bounds checking, allowing a buffer overflow

Correct Incorrect Correct answer

It is slower than memcpy

Correct Incorrect Correct answer

It only works with ASCII characters

Correct Incorrect Correct answer

It requires the input to be null-terminated twice

Correct Incorrect Correct answer

1 point(s)

What defines a DevSecOps pipeline?

Topic: DevSecOps.

Security tests run automatically at every stage of CI/CD, on every change

Correct Incorrect Correct answer

A yearly penetration test performed by an external firm

Correct Incorrect Correct answer

A separate security team that approves each release manually

Correct Incorrect Correct answer

Moving all security testing to after deployment

Correct Incorrect Correct answer

Secure Development

Quizzes

Participants 0

omri sagron 20/09/2026

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

Explore

Programs

Support