Secure Software Development | Practice Test / Quiz / MCQs

Home > CompTIA Security+ Certification > Quizzes > Secure Software Development

Secure Software Development

Fast practice, instant feedback. Timer auto-submits when time’s up.

Avg score: 17% • Most missed: “Planning and analysis”

Study First Challenge a Friend Stats

Secure Software Development

Time left 00:00

25 Questions

1. SDLC Principles

Developers should always remember the 3 tenants of CIA.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Deployment - app or system will be moved into production environment where customer and end users can now utilize it to perform their work. Ex, Windows 10, deployment occurred when it was installed on a new PC or to upgrade from a earlier version OS. This phase allows for real work to be done using your new SW app

2. SW Development Life Cycle (SDLC)

Developers should always remember the 3 tenants of CIA.Deployment - app or system will be moved into production environment where customer and end users can now utilize it to perform their work. Ex, Windows 10, deployment occurred when it was installed on a new PC or to upgrade from a earlier version OS. This phase allows for real work to be done using your new SW appSDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

3. SDLC Principles - Defense in Depth

4. Deployment

A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Deployment - app or system will be moved into production environment where customer and end users can now utilize it to perform their work. Ex, Windows 10, deployment occurred when it was installed on a new PC or to upgrade from a earlier version OS. This phase allows for real work to be done using your new SW appDevelopers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

5. Testing Methods - Dynamic Analysis

6. Testing Methods - Fuzzing (most common type of Dynamic Analysis)

Developers should always remember the 3 tenants of CIA.Injection of randomized data into a software program in an attempt to find system failures, memory leaks, error handling issues, and improper input validation. Finding vulnerabilities. This can be used on a PC, network or system.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

7. Non-Operation Instruction (NOP)

A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Developers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Just a note.

8. Input Validation

Developers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Applications verify that information received from a user matches a specific format or range of values - Example if you put 14/25/2019, error b/c there is no 14th month. ABCD for SSN, error b/c that is not a SSN format of 9 numbers...So input validation ensure the format is correct. A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

9. Software Vulnerabilities and Exploits - Directory Traversal

SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Developers should always remember the 3 tenants of CIA.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Method of accessing unauthorized directories by moving through the directory structure on a remote server. Normally you go to fatskills.com.com/menu, but if you try fatskills/../../..etc/password. This attempts to move up 3 levels of the directory structure from the public folder to the root folder and back down the ETC folder and then attempts to access the password file. ** if you see fatskills.com//../../../ the ../../../ on the test means it is a Directory traversal question

10. SDLC Principles - Create Secure Defaults (developer)

Default installations should include secure confgs instead of requiring an admin or user to add in additional security.Developers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

11. SDK (software development kit)

A group of tools that developers use to write apps. For example, Android Studio is a free SDK that is released as open source. Used for OS, Android...copy and paste trusted code vs recreating the wheel.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Developers should always remember the 3 tenants of CIA.

12. Run-time Error

occurs during execution and most common as they are tested in a real time enviromentSDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Developers should always remember the 3 tenants of CIA.

13. Injection attack

A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Developers should always remember the 3 tenants of CIA.Insertion of additional information or code through data input from a client to an application • SQL • HTML• XML • LDAP - Most common type is an SQL injectionSDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

14. Development Operations (DevOps)

Developers should always remember the 3 tenants of CIA.SW development and IT operations. SW developers and IT work close together to speed up the development and deployment of the app. Get things out to the end user quicker, with that it is a Good idea to imbed a Security Person to ensure good Cybersecurity it not sacrificed in an effort to get the product out quicker.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

15. 3 Types of XSS attacks - Reflected (2 of 3)

Attempts to have a non-persistent effect activated by a victim clicking a link on the site.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Developers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

16. Implementation

Implementation - During this, programmers begin to code all the various function needed for the final product. As each piece of the code if developed, the programmers will conduct basic debugging and testing to ensure it is working properly. No formal testing yet in this phase.Developers should always remember the 3 tenants of CIA.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

17. SDLC Principles - Fix Security Issues

SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)If a vulnerability is ID, then it should be quickly and correctly patched to remove the vulnerability. We don't want known vulnerability in our app/systems can be found and exploited. IF we know, safe to assume attacker knows.Developers should always remember the 3 tenants of CIA.

18. SDLC Principles - Authenticity and Integrity

Developers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Apps should be deployed using code signing to ensure the program is not changed inadvertently or maliciously prior to delivery to an end user. By using digital signatures as part of your code signing you enabling the end user was authentic and maintains the integrity throughout its lifecycle

19. Testing Methods - System Testing White-box

20. Software Vulnerabilities and Exploits - Arbitrary Code Execution (ACE)

Developers should always remember the 3 tenants of CIA.Occurs when an attacker is able to execute or run commands on a victim computer. Ex, someone walks by your PC and you are not there, they start running commands on the victim PC.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

21. Web based Exploit Vulnerabilities - 2 Types (1 of 2) - XSS

Developers should always remember the 3 tenants of CIA.SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Cross-Site Scripting (XSS) - Occurs when an attacker embeds malicious scripting commands on a trusted website. Vicitm is the user, not the webserver, they try to get your cookies and other information stored by the users web-browser etc. They put the malicious code on the site, then you access it and get infected. During an XSS, the user is the victim not the webserver as it has most likely already been compromised. Exploits the trust between the user and the server they are accessing.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

22. SDLC Principles - Threat Modeling

SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Helps prioritize vulnerability ID and patching throughout the SDLC. Best to put money into Cybersecurity up front before releasing, if not, attacks and it cost more on the back end to clean up the mess of an attack.Developers should always remember the 3 tenants of CIA.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

23. Software Vulnerabilities and Exploits - Remote Code Execution (RCE)

Developers should always remember the 3 tenants of CIA.A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)Occurs when an attacker is able to execute or run commands on a ** remote computer This is considered critical under the vulnerability grading systemSDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).

24. Testing Methods - Structured Exception Handling (SEH)

25. SQL (Structured Query Language) Injection (isn't bad, its how we get access, but it can be bad if an attacker uses it)

SDLC is an organized process of developing a security app throughout the life of the project. From Initial idea, to coding, testing and even into deployment and retirement. This is broken down into the Waterfall Model (getting more developed as it does down (think of a staircase).Developers should always remember the 3 tenants of CIA.Attack consisting of the insertion or injection of an SQL query via input data from the client to a web application. An attacker issues a SQL command to a web server as part of the URL or as input to a form on a company's website; web server might pass the command onto the database which then allows potentially anything to be done to the database. In short, just a specialized code injection. When you log in (user/Pass), you are conducting an SQL injection (legit), attacker puts in bad info to gain access A defense that uses multiple types of security devices to protect a network. Also called layered security vs a single control (SPOF, Single Point of Failure)

⚡ Recently practiced quizzes in this topic

Live quiz activity

Cybersecurity Assessment Test Physical Security CompTIA Cybersecurity Analyst Plus CySA+ CS0-001 Questions CompTIA Security+ Certification Exam CompTIA Security+ SY0-601 Certification Exam Terms To Know Hardening Pentest+ CySA+ (CS0-002) Review Questions Virtualization (And Security) Overview of Security

25 Questions

❤ If you liked Fatskills, consider supporting us by checking out The Life Manuals You Never Got.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | OSHA Basics Quiz | What Should We Know?
Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson
© 2026 Fatskills.com

All trademarks, logos and brand names are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement.

25 Questions

❤ If you liked Fatskills, consider supporting us by checking out The Life Manuals You Never Got.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | OSHA Basics Quiz | What Should We Know? Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson© 2026 Fatskills.com

All trademarks, logos and brand names are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | OSHA Basics Quiz | What Should We Know?
Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson
© 2026 Fatskills.com