Chapitre 22
SDLC et écosystème
de développement

What does "shift left" mean in secure software development?

1. Testing only after deployment
2. Integrating security early, from requirements and design onward
3. Moving developers to a new office
4. Delaying security until maintenance

Why is fixing a vulnerability during design cheaper than fixing it in production?

1. Designers are paid less
2. Defects caught earlier require far less rework and impact
3. Production has no bugs
4. It is not cheaper

Which methodology is sequential, completing each phase before the next?

1. Agile
2. Waterfall
3. DevOps
4. Kanban

Which methodology is explicitly risk-driven, performing risk analysis at each iteration?

1. Waterfall
2. Spiral
3. Scrum
4. RAD

Which is one of the four values of the Agile Manifesto?

1. Comprehensive documentation over working software
2. Working software over comprehensive documentation
3. Following a plan over responding to change
4. Processes over individuals

In Scrum, what is a fixed-length development iteration called?

1. A sprint
2. A waterfall
3. A spiral
4. A gate

What does DevSecOps add to DevOps?

1. Slower releases
2. Security integrated and automated throughout the pipeline
3. Manual security testing only at the end
4. Removal of automation

What is the correct order of the five CMMI maturity levels?

1. Defined, Initial, Optimizing, Managed, Quantified
2. Initial, Repeatable/Managed, Defined, Quantitatively Managed, Optimizing
3. Optimizing, Defined, Initial, Managed, Quantified
4. Initial, Optimizing, Defined, Managed, Quantified

At which CMMI level are processes measured and controlled using metrics?

1. Level 1 (Initial)
2. Level 3 (Defined)
3. Level 4 (Quantitatively Managed)
4. Level 5 (Optimizing)

Which maturity model is specifically focused on software security assurance and maintained by OWASP?

1. CMMI
2. SAMM
3. ITIL
4. COBIT

Which statement about compiled versus interpreted languages is correct?

1. Compiled code is executed line by line at runtime
2. Compiled code is translated to machine code before execution; interpreted code runs on the fly
3. They are identical
4. Interpreted languages are always faster

What is the PRIMARY benefit of a memory-safe language?

1. It runs without electricity
2. It prevents entire classes of bugs such as buffer overflows by design
3. It removes the need for testing
4. It compiles faster

The Log4j incident illustrated which supply-chain risk?

1. Hardware counterfeiting
2. Vulnerabilities inherited from third-party libraries and dependencies
3. Physical theft of servers
4. Weak passwords

Which tool analyzes third-party components and dependencies for known vulnerabilities?

1. SAST
2. SCA (Software Composition Analysis)
3. DAST
4. Fuzzing

Which security practice prevents credentials from being committed to a code repository?

1. Secrets scanning
2. Load balancing
3. Degaussing
4. Broadcasting the SSID

Which technology protects an application from inside the running process in production?

1. SAST
2. RASP (Runtime Application Self-Protection)
3. SCA
4. A network firewall

What is the purpose of a security gate in a CI/CD pipeline?

1. To speed up builds by skipping tests
2. To fail the build when a security check (such as SAST) raises a critical finding
3. To delete the source code
4. To disable version control

Which statement BEST describes the Spiral model?

1. A single-pass sequential process
2. An iterative model that repeats risk analysis on each loop
3. A model with no planning
4. A model only for hardware

What is an Integrated Product Team (IPT)?

1. A single developer working alone
2. A multidisciplinary team bringing together all relevant stakeholders
3. A firewall cluster
4. A backup rotation

Which framework scales Agile across a large enterprise?

1. SAFe
2. Waterfall
3. CMMI
4. RAD

Which describes BSIMM?

1. A prescriptive checklist of required controls
2. A descriptive maturity model based on observing real organizations' software security
3. An encryption algorithm
4. A firewall configuration

Which generation of programming languages is closest to natural language and highly abstracted?

1. 1GL (machine code)
2. 2GL (assembly)
3. 4GL
4. Binary

Which practice ensures the integrity and attribution of code changes in a repository?

1. Signed commits
2. Disabling logging
3. Sharing one account
4. Removing version control

Why should the CI/CD pipeline itself be secured?

1. It is not a security concern
2. A compromised pipeline can inject malicious code into every build (a supply-chain attack)
3. Only developers use it
4. It has no access to production

Which API security control limits how many requests a client can make in a period?

1. Rate limiting
2. Degaussing
3. NAT
4. Full disk encryption