CSSLP · Question #251
"Enhancing the Development Life Cycle to Produce Secure Software" summarizes the tools and practices that are helpful in producing secure software. What are these tools and practices? Each correct ans
The correct answer is B. Compiler security checking and enforcement C. Tools to detect memory violations D. Safe software libraries. Enhancing the software development lifecycle to produce secure software involves integrating tools and practices that prevent and detect vulnerabilities.
Question
"Enhancing the Development Life Cycle to Produce Secure Software" summarizes the tools and practices that are helpful in producing secure software. What are these tools and practices? Each correct answer represents a complete solution. Choose three.
Options
- ALeverage attack patterns
- BCompiler security checking and enforcement
- CTools to detect memory violations
- DSafe software libraries
- ECode for reuse and maintainability
How the community answered
(27 responses)- A7% (2)
- B85% (23)
- E7% (2)
Why each option
Enhancing the software development lifecycle to produce secure software involves integrating tools and practices that prevent and detect vulnerabilities.
Leveraging attack patterns helps developers understand potential threats and design more resilient software, but it is a strategy for analysis and design, not a direct tool or practice for producing secure software.
Compiler security checking and enforcement helps identify common coding errors and potential vulnerabilities early in the development process, improving code quality and security.
Tools to detect memory violations, such as buffer overflows or use-after-free errors, are crucial for identifying and mitigating critical security flaws often exploited in software attacks.
Using safe software libraries means incorporating pre-vetted, secure components, which reduces the likelihood of introducing vulnerabilities through poorly implemented or insecure third-party code.
Code for reuse and maintainability is a good software engineering practice that can indirectly improve security by reducing complexity and bugs, but it is not a direct security-specific tool or practice itself.
Concept tested: Secure software development practices and tools
Source: https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.