A security architect is assigned to a major software development project. The software development team has a history of writing bug prone, inefficient code, with multiple security flaws in every…

Question

Options

• Aerror handling, input validation, memory use and reuse, race condition handling, commenting, and
• Berror prevention, requirements validation, memory use and reuse, commenting typical security problems,
• Cerror elimination, trash collection, documenting race conditions, peer review, and typical security problems.
• Derror handling, input validation, commenting, preventing typical security problems, managing customers,

• A
  83% (15)
• B
  6% (1)
• C
  11% (2)

Explanation

Recognized secure coding standards (such as CERT, OWASP, or SANS guidelines) center on: error handling (not 'elimination' or 'prevention', which are unrealistic), input validation (to prevent injection attacks), proper memory use and reuse (to prevent buffer overflows and use-after-free bugs), race condition handling (to prevent TOCTOU vulnerabilities), and documenting/preventing typical security problems. Option B uses non-standard terms like 'requirements validation' and 'error prevention' that are not part of coding standards. Option C introduces 'trash collection' (not a standard term) and frames race conditions as something to document rather than handle. Option D includes 'managing customers,' which is a project management concern, not a coding standard. Option A reflects the actual content of industry-accepted secure coding standards.

No community discussion yet for this question.