SC-100 · Question #47
You are creating an application lifecycle management process based on the Microsoft Security Development Lifecycle (SDL). You need to recommend a security standard for onboarding applications to…
The correct answer is C. threat modeling by using the Microsoft Threat Modeling Tool. Threat modeling using the Microsoft Threat Modeling Tool (C) is the correct activity for the application design phase of the Microsoft Security Development Lifecycle (SDL). Threat modeling involves identifying potential threats, attack surfaces, and security vulnerabilities…
Question
You are creating an application lifecycle management process based on the Microsoft Security Development Lifecycle (SDL). You need to recommend a security standard for onboarding applications to Azure. The standard will include recommendations for application design, development, and deployment. What should you include during the application design phase?
Options
- Astatic application security testing (SAST) by using SonarQube
- Bdynamic application security testing (DAST) by using Veracode
- Cthreat modeling by using the Microsoft Threat Modeling Tool
- Dsoftware decomposition by using Microsoft Visual Studio Enterprise
How the community answered
(16 responses)- A6% (1)
- B19% (3)
- C75% (12)
Explanation
Threat modeling using the Microsoft Threat Modeling Tool (C) is the correct activity for the application design phase of the Microsoft Security Development Lifecycle (SDL). Threat modeling involves identifying potential threats, attack surfaces, and security vulnerabilities during the architectural design stage - before any code is written - making it the most cost-effective time to address security issues. SAST using SonarQube (A) is a development/coding-phase activity that analyzes source code. DAST using Veracode (B) is a testing-phase activity that analyzes running applications. Software decomposition in Visual Studio Enterprise (D) is not a defined SDL security practice for the design phase.
Topics
Community Discussion
No community discussion yet for this question.