Nordholm Systems’ verification-phase practices span a wide range: automated testing tools, manual code reviews, dedicated security test cases, penetration testing, and more. When the security lead asks which single practice her engineers both use the most and rate as most impactful for security, one activity stands out clearly above the rest. Which one, and why does that pairing matter?

Nordholm Systems’ security lead ranks the company’s design-phase security activities by how often teams actually do them. Application security configuration comes out on top for sheer frequency of use — yet when the same engineers rate how much it helps security, it scores among the lowest of any design-phase activity. Meanwhile design requirements and abuse-or-misuse cases are both used often *and* rated as genuinely high-impact. Which of the following statements holds up against that pattern? (Select all that apply.)

At Nordholm Systems’ next retrospective, the team compares its implementation-phase practices: coding standards are followed almost universally and engineers consistently rate them as one of the most valuable security practices they use, while more specialized security tooling sees much lower adoption. A new hire asks why something as basic as a coding standard would rate above dedicated security tools. What’s the likely explanation?

At Nordholm Systems, architecture and application-development guidelines are one of the requirements-phase documents nearly every team consults, yet when engineers are surveyed internally on how much those guidelines actually contribute to security, the ratings come back surprisingly low. A junior architect assumes this must mean the guidelines are outdated. What’s a more likely explanation?

After a sprint, Trellis Health’s scheduling feature passes every acceptance test the product owner wrote: patients can search for a slot, book it, and receive a confirmation, exactly as the user stories describe. The team demos it and calls it secure, since “all the tests are green.” What’s the flaw in that conclusion?

During a pre-launch security review of Northfield Retail’s checkout platform, the audit team finds a customer-profile page that renders a shopper’s saved display name straight into the HTML. A developer on the call argues it needs no special handling because the value came from Northfield’s own database and is therefore trusted — until the auditor points out that a display name saved months earlier is already firing a stored XSS payload in every visitor’s browser. What principle should have been applied?

As part of a pre-launch security review, Northfield Retail’s own username/password authentication and session-management system — built in house two years ago — comes under scrutiny. The lead engineer checks the existing design against NIST 800-63-B’s digital-identity guidelines rather than guessing at password and session rules, and notes that a managed identity service such as Auth0 would also have been an acceptable choice when the system was first built. True or False: this is a reasonable way to handle digital identity securely.

Find z for the formula  z = x-xs  when x = 4.156, x= 2.534 and s= 4.128   Round to three decimal places

Find the mean and and median of the following numbers:  10, 11, 13, 14, 14, 17, 18, 20, 21, 25, 28Mean =Median =

The heights of giraffes follow a bell shaped distributed with a mean of  65.2 inches and a standard deviation of 1.4 inches.  The heights of elephants are bell shaped with a mean of 69.1 inches tall with a standard deviation of 1.2 inches.  Answer the following and round your answers to 2 decimal places. a.  What is the z-score for the height of a giraffe who is 67 inches tall? [answer1] b.  What is the z-score for the height of an elephant who is 68 inches tall? [answer2]