Developer training focused on secure development

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Why does an organisation provide ongoing secure coding training for its developers?

A To replace the need for code reviews and testing

B To build skills for writing secure code, which reduces human error

2. A developer receives an urgent email asking them to click a link and re-enter their repository password. What does phishing awareness training teach them to do?

A Spot the warning signs and report the email instead of clicking

B Click the link quickly to avoid being locked out

3. Which is the BEST example of refresher training?

A Developers complete one induction course and are never trained again

B Developers repeat a short secure coding course every year as threats change

4. A data breach was caused by a developer who left an API key in source code. How should the organisation use this incident for training?

A Share the lessons learned and train all developers on managing secrets

B Keep it quiet so other developers do not worry

5. True or false: Developer training can reduce the risk of human error, one type of insider threat.

A True

B False

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1training.repeat(every = 'year')		ARefresher training repeats secure development lessons regularly so developers' skills and awareness stay current.
2if email.isSuspicious(): report()		Bdb.query('SELECT * FROM users WHERE id = ?', [id])
3Secure coding training teaches developers to handle user input safely, so a lack of knowledge does not create vulnerabilities.		CThe code trusts a sender's claimed identity without verifying it. This is a social engineering weakness that awareness training teaches developers to avoid.
4Learning from incidents means turning the lessons of a past incident into new training for developers.		Dtraining.add(incident.lessonsLearned)
5training.completed = True # one-off, never repeated		ETraining is treated as a one-off task. Skills fade and new threats appear, so developer training must be ongoing with refreshers.
6if sender == 'IT Support': sendPassword()		FPhishing and social engineering awareness training teaches developers to spot suspicious messages and report them.

Definitions

Developer training

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF monthsSinceTraining > 12 THEN SEND _______________(developer) END IF

IF emailHasSuspiciousLink THEN ______________(email) END IF

IF developer.trained = _____ THEN enrol(developer, "secure coding") END IF

FUNCTION learnFromIncident(incident) updateTraining(incident._____) END FUNCTION

risk ← baseRisk _ trainingEffect DISPLAY risk

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A trained = 0

B for dev in team

C if dev.completed_training:

D trained = trained + 1

Question 2

A months = 14

B LIMIT = 12

C if months < LIMIT:

D print("Refresher due")

Question 3

A define report_phish(email):

B if email.bad_link:

C notify(security_team)

D return True

Question 4

A score = 85

B PASS_MARK = 80

C if score >= PASS_MARK:

D print("Training passed)

Question 5

A incident = "phishing email"

B lesson = "Check sender first"

C training.add(lessons)

D print("Module updated")

Answer Key

Developer training focused on secure development

Section A: Quick Questions

B — To build skills for writing secure code, which reduces human error

A — Spot the warning signs and report the email instead of clicking

B — Developers repeat a short secure coding course every year as threats change

A — Share the lessons learned and train all developers on managing secrets

A — True

Section B: Match the Pairs

training.repeat(every = 'year') → Refresher training repeats secure development lessons regularly so developers' skills and awareness stay current.

if email.isSuspicious(): report() → Phishing and social engineering awareness training teaches developers to spot suspicious messages and report them.

Secure coding training teaches developers to handle user input safely, so a lack of knowledge does not create vulnerabilities. → db.query('SELECT * FROM users WHERE id = ?', [id])

Learning from incidents means turning the lessons of a past incident into new training for developers. → training.add(incident.lessonsLearned)

training.completed = True # one-off, never repeated → Training is treated as a one-off task. Skills fade and new threats appear, so developer training must be ongoing with refreshers.

if sender == 'IT Support': sendPassword() → The code trusts a sender's claimed identity without verifying it. This is a social engineering weakness that awareness training teaches developers to avoid.

Section C: Definitions

Developer training — Ongoing training that gives developers the skills and awareness to write secure code and spot threats such as phishing, which reduces human error.

Section D: Fill in the Blanks

IF monthsSinceTraining > 12 THEN
    SEND refresherCourse(developer)
END IF

IF emailHasSuspiciousLink THEN
    reportPhishing(email)
END IF

IF developer.trained = FALSE THEN
    enrol(developer, "secure coding")
END IF

FUNCTION learnFromIncident(incident)
    updateTraining(incident.cause)
END FUNCTION

risk ← baseRisk - trainingEffect
DISPLAY risk

Section E: Spot the Error

B — The for loop header is missing its colon. It should be 'for dev in team:' so the loop counts each developer who completed training.

C — The comparison is the wrong way round. Refresher training is due when the months since training are greater than the limit, so it should be 'if months > LIMIT:'.

A — Python functions are defined with the keyword 'def', not 'define'. The line should be 'def report_phish(email):'.

D — The string is missing its closing double quote. It should be print("Training passed").

C — The variable is called lesson, not lessons, so this would cause a NameError. When learning from an incident, the lesson should be added to the training with training.add(lesson).