Secure SDLC practices in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Purpose of Secure SDLC

What is the main goal of integrating security practices into the Software Development Life Cycle (SDLC)?

A To ensure software is developed faster by skipping testing phases

B To reduce security risks by embedding security measures throughout development

C To outsource all security tasks to a third-party after development

D To focus only on fixing bugs after the software is released

💡 Hint

Think about how security can be improved by acting early rather than later.

Secure SDLC aims to reduce security risks by including security activities at every stage of software development, rather than addressing security only after release.

📋 Factual

intermediate

Key Phases of Secure SDLC

Which of the following is NOT typically a phase in a Secure SDLC process?

A Requirements gathering with security considerations

B Security testing and code review

C Designing with threat modeling

D Ignoring security until after deployment

💡 Hint

Consider when security activities should happen during development.

Ignoring security until after deployment is not part of Secure SDLC. Security should be integrated from the start.

🔍 Analysis

advanced

Impact of Early Security Testing

What is the most significant benefit of performing security testing early in the SDLC?

A It delays the project timeline significantly

B It allows skipping other testing phases

C It helps identify and fix vulnerabilities before they become costly

D It increases the cost of fixing security issues later

💡 Hint

Think about the cost and effort of fixing problems at different stages.

Early security testing helps find vulnerabilities when they are easier and cheaper to fix, reducing risks and costs later.

❓ Comparison

advanced

Comparing Threat Modeling Approaches

Which statement best describes the difference between asset-based and attacker-based threat modeling in Secure SDLC?

A Asset-based identifies valuable assets to protect, attacker-based focuses on attacker goals and methods

B Asset-based focuses on potential attackers, attacker-based focuses on software assets

C Both approaches ignore the software environment

D Attacker-based is only used after deployment

💡 Hint

Consider what each approach prioritizes in identifying threats.

Asset-based threat modeling identifies what valuable assets need protection, while attacker-based focuses on understanding attacker goals and methods to anticipate threats.

❓ Reasoning

expert

Evaluating Secure SDLC Integration Challenges

Which challenge is most likely to occur when integrating security practices into an existing SDLC without proper planning?

A Resistance from developers due to increased workload and unclear processes

B Improved team communication and faster releases

C Automatic elimination of all security vulnerabilities

D Reduced need for security training

💡 Hint

Think about human factors and process changes when adding new steps.

Without proper planning, developers may resist security integration because it adds workload and may not be clearly defined, causing delays and friction.

Practice

1. What is the main goal of Secure SDLC (Software Development Life Cycle)?

easy

A. To focus only on fixing bugs after software release

B. To speed up software development by skipping testing

C. To integrate security measures throughout the software development process

D. To design software without considering user needs

Solution

1. Step 1: Understand the purpose of Secure SDLC

   Secure SDLC aims to include security at every stage of software creation, not just at the end.

2. Step 2: Compare options with this goal

   Only To integrate security measures throughout the software development process describes integrating security throughout the process, which matches the goal.

3. Final Answer:

   To integrate security measures throughout the software development process -> Option C

4. Quick Check:

   Secure SDLC = Integrate security [OK]

Hint: Secure SDLC means adding security from start to finish [OK]

Common Mistakes:

• Thinking security is only for testing phase
• Believing Secure SDLC speeds up development by skipping steps
• Assuming Secure SDLC ignores user needs

2. Which of the following is a correct practice in Secure SDLC during the development phase?

easy

A. Performing static code analysis to find vulnerabilities

B. Ignoring code reviews to save time

C. Skipping security testing until after deployment

D. Allowing unrestricted access to source code

Solution

1. Step 1: Identify secure development practices

   Static code analysis helps find security issues early in development.

2. Step 2: Evaluate each option

   Performing static code analysis to find vulnerabilities is a known secure practice; others ignore security or increase risk.

3. Final Answer:

   Performing static code analysis to find vulnerabilities -> Option A

4. Quick Check:

   Development phase = Static code analysis [OK]

Hint: Use static code analysis during development [OK]

Common Mistakes:

• Skipping code reviews thinking they waste time
• Delaying security testing until after deployment
• Not protecting source code access

3. Consider this simplified Secure SDLC checklist code snippet:

phases = ['Planning', 'Design', 'Development', 'Testing', 'Deployment']
security_checks = {'Planning': True, 'Design': True, 'Development': False, 'Testing': True, 'Deployment': True}
secure_phases = [phase for phase in phases if security_checks.get(phase)]
print(secure_phases)

What will be the output?

medium

A. []

B. ['Planning', 'Design', 'Development', 'Testing', 'Deployment']

C. ['Development']

D. ['Planning', 'Design', 'Testing', 'Deployment']

Solution

1. Step 1: Understand the list comprehension filtering

   The code selects phases where security_checks is True.

2. Step 2: Check each phase's security status

   'Development' is False, so it is excluded; others are True and included.

3. Final Answer:

   ['Planning', 'Design', 'Testing', 'Deployment'] -> Option D

4. Quick Check:

   Filter True phases = ['Planning', 'Design', 'Testing', 'Deployment'] [OK]

Hint: Filter list by True values in dictionary [OK]

Common Mistakes:

• Including phases with False security checks
• Confusing list comprehension syntax
• Assuming all phases are included

4. A developer wrote this code to check if all SDLC phases have security checks:

phases = ['Planning', 'Design', 'Development', 'Testing', 'Deployment']
security_checks = {'Planning': True, 'Design': True, 'Development': False, 'Testing': True, 'Deployment': True}
all_secure = all(security_checks[phase] for phase in phases)
print(all_secure)

What is the output and why?

medium

A. True, because most phases have security checks

B. False, because 'Development' phase lacks security checks

C. Error, because of incorrect dictionary access

D. None, because the variable is not assigned

Solution

1. Step 1: Understand the all() function usage

   all() returns True only if every item is True; here it checks each phase's security status.

2. Step 2: Check security status for each phase

   'Development' is False, so all() returns False.

3. Final Answer:

   False, because 'Development' phase lacks security checks -> Option B

4. Quick Check:

   all() with one False = False [OK]

Hint: all() is False if any item is False [OK]

Common Mistakes:

• Assuming all() returns True if most are True
• Thinking dictionary access causes error here
• Confusing all() with any()

5. You want to improve security in the SDLC by adding automated security testing after development and before deployment. Which practice best fits this goal?

hard

A. Integrate continuous security testing tools in the CI/CD pipeline

B. Perform manual security reviews only after deployment

C. Skip testing to speed up deployment

D. Allow developers to decide if security testing is needed

Solution

1. Step 1: Identify the goal of adding automated security testing

   The goal is to catch security issues early and continuously during development.

2. Step 2: Evaluate options for fitting this goal

   Integrate continuous security testing tools in the CI/CD pipeline uses automated tools integrated in CI/CD, ensuring continuous checks before deployment.

3. Final Answer:

   Integrate continuous security testing tools in the CI/CD pipeline -> Option A

4. Quick Check:

   Automated testing in CI/CD = Best practice [OK]

Hint: Use automated tests in CI/CD for continuous security [OK]

Common Mistakes:

• Relying only on manual reviews after deployment
• Skipping testing to save time
• Leaving security testing optional