I9 Secure Coding Basics Module Test
Complete this twenty-five-question assessment covering secure development, threat modeling, input and output safety, identity, sessions, authorization, errors, logging, secrets, dependencies, builds, configuration, review, testing, deployment, evidence, and closure.
Readiness Check
Module Test Readiness
0/5 ready
Assessment Rules
How to Use This Module Test
Before revealing answers
Read the full question, compare all choices, and select the strongest evidence-based defensive response.
After revealing answers
Record missed questions, explain why your choice was weaker, and connect the correct answer to the matching lesson.
Scoring
Give yourself one point for each correct answer. Use the score guide only after completing all twenty-five questions.
Professional standard
Strong answers preserve exact scope, trusted controls, multiple evidence sources, legitimate workflows, ownership, and measurable closure.
Check Your Understanding
I9 Secure Coding Basics: 25-Question Module Test
Choose your answers first. Explanations appear only after submission.
1. Which statement best describes a secure development lifecycle?
2. What is the strongest purpose of a threat model?
3. Why is a trust boundary important?
4. Which input-validation design is strongest?
5. What does parameterization primarily protect?
6. Why must stored data still be handled safely when displayed?
7. Which file-upload approach is strongest?
8. Which statement correctly separates authentication and authorization?
9. Which object-authorization design is strongest?
10. Why should a session rotate after sign-in or privilege elevation?
11. What should happen after an account role is removed?
12. Which user-facing error response is strongest?
13. Why are structured events stronger than unbounded free-form log strings?
14. Which value should never appear completely in standard logs?
15. What should secret rotation include?
16. What is the strongest service-identity design?
17. What is the strongest way to prioritize a dependency advisory?
18. Why are lockfiles useful?
19. Which build-pipeline design is strongest?
20. What does artifact integrity most directly support?
21. How should a static-analysis warning be handled?
22. Why are positive and negative tests both required?
23. What makes a regression test valuable?
24. Which finding statement is strongest?
25. Which evidence best supports closure of a secure-coding finding?
Score Guide
Interpret Your Result
23–25 correct
Advanced Module Mastery
You can connect secure development, implementation, testing, deployment, evidence, and closure across the module.
20–22 correct
Strong Readiness
Review missed questions and explain why the best answer is stronger than every alternative.
16–19 correct
Developing Readiness
Revisit the matching lessons and repeat the test after completing the mastery checklist.
0–15 correct
More Review Recommended
Focus on trusted server controls, evidence chains, validation, and professional closure.
Mastery Review
Connect Missed Questions to the Correct Lessons
Control area
Secure development and threat modeling
Mastery statement
Requirements, assets, trust boundaries, misuse cases, controls, owners, evidence, and residual risk.
Review
I9.1–I9.2
Control area
Input, output, and data handling
Mastery statement
Server contracts, parameterization, output contexts, files, minimization, retention, and deletion.
Review
I9.3
Control area
Identity, sessions, and authorization
Mastery statement
Authentication, current sessions, object and tenant access, workflow state, and privileged approval.
Review
I9.4
Control area
Errors, logs, and secrets
Mastery statement
Safe errors, structured minimized evidence, redaction, managed secrets, service identities, and source health.
Review
I9.5
Control area
Dependencies, build, and configuration
Mastery statement
Component risk, pipelines, artifacts, baselines, deployment validation, drift, rollback, and exceptions.
Review
I9.6
Control area
Code review, testing, and closure
Mastery statement
Tool validation, positive and negative tests, regression coverage, findings, deployment, monitoring, and closure.
Review
I9.7–I9.8
Defender Habits
I9 Module Mastery Checklist
Portfolio Prompt
Final Module Portfolio Check
Create a one-page fictional Secure Coding Basics Summary connecting one requirement, one threat model, one implementation finding, one safe test, one remediation, one regression test, one deployment validation, one monitoring result, one residual-risk statement, and one owner approval.
Key Takeaways
What You Should Remember
Navigation