Secure SDLC practices in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the phase where security requirements are gathered.

Cybersecurity

The [1] phase involves collecting security needs for the software.

Drag options to blanks, or click blank then click option'

ADesign

BTesting

CRequirements

DDeployment

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing design with requirements

Thinking testing is where requirements are gathered

The Requirements phase is where security needs are identified and documented to guide the rest of the development.

2fill in blank

medium

Complete the code to name the phase where security controls are planned.

Cybersecurity

During the [1] phase, security controls and architecture are defined.

Drag options to blanks, or click blank then click option'

AImplementation

BRequirements

CMaintenance

DDesign

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing implementation instead of design

Mixing requirements with design

The Design phase is when the software's structure and security controls are planned before coding starts.

3fill in blank

hard

Fix the error in naming the phase where code is checked for security flaws.

Cybersecurity

Security flaws are identified during the [1] phase.

Drag options to blanks, or click blank then click option'

ATesting

BDeployment

CRequirements

DDesign

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing testing with deployment

Thinking design phase finds flaws

The Testing phase is when the software is examined to find and fix security vulnerabilities before release.

4fill in blank

hard

Fill both blanks to describe the phases where security is integrated and maintained.

Cybersecurity

Security is integrated during the [1] phase and monitored in the [2] phase.

Drag options to blanks, or click blank then click option'

AImplementation

BMaintenance

CDeployment

DRequirements

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing deployment with maintenance

Confusing requirements with implementation

Security controls are applied during Implementation, and ongoing security is maintained during Maintenance.

5fill in blank

hard

Fill all three blanks to complete the secure SDLC phases in order.

Cybersecurity

The phases are [1], [2], and [3] in the early stage of Secure SDLC.

Drag options to blanks, or click blank then click option'

ARequirements

BDesign

CImplementation

DTesting

Attempts:

3 left

💡 Hint

Common Mistakes

Including testing too early

Mixing order of phases

The early stages of Secure SDLC start with Requirements, then Design, followed by Implementation.

Practice

1. What is the main goal of Secure SDLC (Software Development Life Cycle)?

easy

A. To focus only on fixing bugs after software release

B. To speed up software development by skipping testing

C. To integrate security measures throughout the software development process

D. To design software without considering user needs

Solution

1. Step 1: Understand the purpose of Secure SDLC

   Secure SDLC aims to include security at every stage of software creation, not just at the end.

2. Step 2: Compare options with this goal

   Only To integrate security measures throughout the software development process describes integrating security throughout the process, which matches the goal.

3. Final Answer:

   To integrate security measures throughout the software development process -> Option C

4. Quick Check:

   Secure SDLC = Integrate security [OK]

Hint: Secure SDLC means adding security from start to finish [OK]

Common Mistakes:

• Thinking security is only for testing phase
• Believing Secure SDLC speeds up development by skipping steps
• Assuming Secure SDLC ignores user needs

2. Which of the following is a correct practice in Secure SDLC during the development phase?

easy

A. Performing static code analysis to find vulnerabilities

B. Ignoring code reviews to save time

C. Skipping security testing until after deployment

D. Allowing unrestricted access to source code

Solution

1. Step 1: Identify secure development practices

   Static code analysis helps find security issues early in development.

2. Step 2: Evaluate each option

   Performing static code analysis to find vulnerabilities is a known secure practice; others ignore security or increase risk.

3. Final Answer:

   Performing static code analysis to find vulnerabilities -> Option A

4. Quick Check:

   Development phase = Static code analysis [OK]

Hint: Use static code analysis during development [OK]

Common Mistakes:

• Skipping code reviews thinking they waste time
• Delaying security testing until after deployment
• Not protecting source code access

3. Consider this simplified Secure SDLC checklist code snippet:

phases = ['Planning', 'Design', 'Development', 'Testing', 'Deployment']
security_checks = {'Planning': True, 'Design': True, 'Development': False, 'Testing': True, 'Deployment': True}
secure_phases = [phase for phase in phases if security_checks.get(phase)]
print(secure_phases)

What will be the output?

medium

A. []

B. ['Planning', 'Design', 'Development', 'Testing', 'Deployment']

C. ['Development']

D. ['Planning', 'Design', 'Testing', 'Deployment']

Solution

1. Step 1: Understand the list comprehension filtering

   The code selects phases where security_checks is True.

2. Step 2: Check each phase's security status

   'Development' is False, so it is excluded; others are True and included.

3. Final Answer:

   ['Planning', 'Design', 'Testing', 'Deployment'] -> Option D

4. Quick Check:

   Filter True phases = ['Planning', 'Design', 'Testing', 'Deployment'] [OK]

Hint: Filter list by True values in dictionary [OK]

Common Mistakes:

• Including phases with False security checks
• Confusing list comprehension syntax
• Assuming all phases are included

4. A developer wrote this code to check if all SDLC phases have security checks:

phases = ['Planning', 'Design', 'Development', 'Testing', 'Deployment']
security_checks = {'Planning': True, 'Design': True, 'Development': False, 'Testing': True, 'Deployment': True}
all_secure = all(security_checks[phase] for phase in phases)
print(all_secure)

What is the output and why?

medium

A. True, because most phases have security checks

B. False, because 'Development' phase lacks security checks

C. Error, because of incorrect dictionary access

D. None, because the variable is not assigned

Solution

1. Step 1: Understand the all() function usage

   all() returns True only if every item is True; here it checks each phase's security status.

2. Step 2: Check security status for each phase

   'Development' is False, so all() returns False.

3. Final Answer:

   False, because 'Development' phase lacks security checks -> Option B

4. Quick Check:

   all() with one False = False [OK]

Hint: all() is False if any item is False [OK]

Common Mistakes:

• Assuming all() returns True if most are True
• Thinking dictionary access causes error here
• Confusing all() with any()

5. You want to improve security in the SDLC by adding automated security testing after development and before deployment. Which practice best fits this goal?

hard

A. Integrate continuous security testing tools in the CI/CD pipeline

B. Perform manual security reviews only after deployment

C. Skip testing to speed up deployment

D. Allow developers to decide if security testing is needed

Solution

1. Step 1: Identify the goal of adding automated security testing

   The goal is to catch security issues early and continuously during development.

2. Step 2: Evaluate options for fitting this goal

   Integrate continuous security testing tools in the CI/CD pipeline uses automated tools integrated in CI/CD, ensuring continuous checks before deployment.

3. Final Answer:

   Integrate continuous security testing tools in the CI/CD pipeline -> Option A

4. Quick Check:

   Automated testing in CI/CD = Best practice [OK]

Hint: Use automated tests in CI/CD for continuous security [OK]

Common Mistakes:

• Relying only on manual reviews after deployment
• Skipping testing to save time
• Leaving security testing optional