Free 312-95 sample questions

Correct answer: Using approved tools, deprecating unsafe functions, and performing static analysis

In the Microsoft SDL, the Implementation phase strictly requires developers to use approved tools/compilers, deprecate unsafe functions (like older cryptographic algorithms or unmanaged unsafe code), and perform Static Application Security Testing (SAST). Threat modeling belongs to the Design phase. Dynamic analysis and fuzz testing belong to the Verification phase. Incident Response planning belongs to the Release phase. flowchart LR A[Design] -->|Transitions to| B[Implementation] B --> C[Use Approved Tools] B --> D[Deprecate Unsafe Functions] B --> E[Static Analysis]

Correct answers: Remote Code Execution (RCE) via malicious object graphs; Denial of Service (DoS) through resource exhaustion

BinaryFormatter is notoriously unsafe and is heavily deprecated in modern .NET because it can instantiate arbitrary types present in the application's loaded assemblies. An attacker can craft a malicious serialized payload that, when deserialized, executes arbitrary code (RCE). Additionally, it can lead to Denial of Service (DoS) by allocating massive objects or causing infinite loops during the deserialization process. It does not inherently cause SQL injection or direct DOM-based XSS.

BinaryFormatter is notoriously unsafe and is heavily deprecated in modern .NET because it can instantiate arbitrary types present in the application's loaded assemblies. An attacker can craft a malicious serialized payload that, when deserialized, executes arbitrary code (RCE). Additionally, it can lead to Denial of Service (DoS) by allocating massive objects or causing infinite loops during the deserialization process. It does not inherently cause SQL injection or direct DOM-based XSS.

Correct answer: False

False. Defining RBAC matrices and specifying encryption algorithms are explicitly security activities (or security requirements). Functional activities describe what the system should do for the user (e.g., 'The system must allow a user to add items to a cart'), whereas security activities dictate how the system must protect itself and its data (e.g., 'The system must encrypt cart data using AES-256').

Correct answer: Perform risk assessment

The SQUARE methodology consists of 9 steps. Step 1 is Agree on definitions. Step 2 is Identify security goals. Step 3 is Develop artifacts. Step 4 is Perform risk assessment. After developing the artifacts, the team must assess the risks to identify vulnerabilities and threats before selecting elicitation techniques (Step 5) and actually eliciting the security requirements (Step 6).

Correct answer: The OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) Model

The OCTAVE model is specifically designed as a self-directed information security risk evaluation methodology. It focuses on organizational risk and strategic practice rather than just technological flaws. Phase 1 builds asset-based threat profiles (organizational view), Phase 2 identifies infrastructure vulnerabilities (technological view), and Phase 3 develops security strategies and plans. SQUARE is focused on eliciting requirements rather than organizational risk profiling. STRIDE is a technical threat modeling tool, not an organizational risk assessment framework. flowchart TD A[Phase 1: Build Asset-Based Threat Profiles] --> B[Phase 2: Identify Infrastructure Vulnerabilities] B --> C[Phase 3: Develop Security Strategy and Plans]

Correct answer: A Security Use Case

This is a Security Use Case. It describes the exact behavior the system must exhibit to protect itself against a specific threat (brute force). An Abuse Case would describe the attacker's action (e.g., 'An attacker uses a script to guess passwords rapidly'). A functional use case describes standard user behavior (e.g., 'A user logs in with valid credentials').