Quiz
Secure Software Development Final
Fragen in diesem Quiz (182)
1The PRIMARY reason for incorporating security into the software
development life cycle is to protect- Athe unauthorized disclosure of information.
- Bthe corporate brand and reputation
- Cagainst hackers who intend to misuse the software.
- Dthe developers from releasing software with security defects.
2The resiliency of software to withstand attacks that attempt modify or
alter data in an unauthorized manner is referred to as- AConfidentiality.
- BIntegrity.
- CAvailability.
- DAuthorization.
3The MAIN reason as to why the availability aspects of software must
be part of the organization’s software security initiatives is:- Asoftware issues can cause downtime to the business.
- Bdevelopers need to be trained in the business continuity procedures.
- Ctesting for availability of the software and data is often ignored.
- Dhackers like to conduct Denial of Service (DoS) attacks against
the organization.
4Developing the software to monitor its functionality and report when
the software is down and unable to provide the expected service to the
business is a protection to assure which of the following?- AConfidentiality.
- BIntegrity.
- CAvailability.
- DAuthentication.
5When a customer attempts to log into their bank account, the customer
is required to enter a nonce from the token device that was issued to
the customer by the bank. This type of authentication is also known
as which of the following?- AOwnership based authentication.
- BTwo factor authentication.
- CCharacteristic based authentication.
- DKnowledge based authentication.
6Multi-factor authentication is most closely related to which of the
following security design principles?- ASeparation of Duties.
- BDefense in depth.
- CComplete mediation.
- DOpen design.
7Audit logs can be used for all of the following EXCEPT
- Aproviding evidentiary information.
- Bassuring that the user cannot deny their actions.
- Cdetecting the actions that were undertaken.
- Dpreventing a user from performing some unauthorized operations.
8Organizations often pre-determine the acceptable number of user
errors before recording them as security violations. This number is
otherwise known as:- AClipping level.
- BKnown Error.
- CMinimum Security Baseline.
- DMaximum Tolerable Downtime.
9A security principle that maintains the confidentiality, integrity and
availability of the software and data, besides allowing for rapid recovery
to the state of normal operations, when unexpected events occur is the
security design principle of- Adefense in depth.
- Beconomy of mechanisms.
- Cfail secure
- Dpsychological acceptability
10Requiring the end user to accept an ‘AS-IS’ disclaimer clause before
installation of your software is an example of risk- Aavoidance.
- Bmitigation.
- Ctransference.
- Dacceptance.
11An instrument that is used to communicate and mandate organizational
and management goals and objectives at a high level is a- Astandard.
- Bpolicy.
- Cbaseline.
- Dguideline.
12The Systems Security Engineering Capability Maturity Model (SSECMM
®) is an internationally recognized standard that publishes
guidelines to- Aprovide metrics for measuring the software and its behavior, and
using the software in a specific context of use. - Bevaluate security engineering practices and organizational
management processes. - Csupport accreditation and certification bodies that audit and
certify information security management systems. - Densure that the claimed identity of personnel are appropriately
verified.
- Aprovide metrics for measuring the software and its behavior, and
13Which of the following is a framework that can be used to develop
a risk based enterprise security architecture by determining security
requirements after analyzing the business initiatives.- ACapability Maturity Model Integration (CMMI)
- BSherwood Applied Business Security Architecture (SABSA)
- CControl Objectives for Information and related Technology
(COBIT®) - DZachman Framework
14Which of the following is a PRIMARY consideration for the software
publisher when selling Commercially Off the Shelf (COTS) software?- AService Level Agreements (SLAs).
- BIntellectual Property protection.
- CCost of customization.
- DReview of the code for backdoors and Trojan horses.
15The Single Loss Expectancy can be determined using which of the
following formula?- AAnnualized Rate of Occurrence (ARO) x Exposure Factor
- BProbability x Impact
- CAsset Value x Exposure Factor
- DAnnualized Rate of Occurrence (ARO) x Asset Value
16Implementing IPSec to assure the confidentiality of data when it is
transmitted is an example of risk- Aavoidance.
- Btransference.
- Cmitigation.
- Dacceptance.
17The Federal Information Processing Standard (FIPS) that prescribe
guidelines for biometric authentication is- AFIPS 140.
- BFIPS 186.
- CFIPS 197.
- DFIPS 201.
18Which of the following is a multi-faceted security standard that is
used to regulate organizations that collects, processes and/or stores
cardholder data as part of their business operations?- AFIPS 201.
- BISO/IEC 15408.
- CNIST SP 800-64.
- DPCI DSS.
19Which of the following is the current Federal Information Processing
Standard (FIPS) that specifies an approved cryptographic algorithm to
ensure the confidentiality of electronic data?- ASecurity Requirements for Cryptographic Modules (FIPS 140).
- BPeronal Identity Verification (PIV) of Federal Employees and
Contractors (FIPS 201). - CAdvanced Encryption Standard (FIPS 197).
- DDigital Signature Standard (FIPS 186).
20The organization that publishes the ten most critical web application
security risks (Top Ten) is the- AComputer Emergency Response Team (CERT).
- BWeb Application Security Consortium (WASC).
- COpen Web Application Security Project (OWASP).
- DForums for Incident Response and Security Teams (FIRST)
21The process of removing private information from sensitive data sets is
referred to as- ASanitization.
- BDegaussing.
- CAnonymization.
- DFormatting.
22(Domain 2)
Which of the following MUST be addressed by software security
requirements? Choose the BEST answer- ATechnology used in building the application
- BGoals and objectives of the organization.
- CSoftware quality requirements
- DExternal auditor requirements
23Which of the following types of information is exempt from
confidentiality requirements?- ADirectory information.
- BPersonally identifiable information (PII).
- CUser’s card holder data.
- DSoftware architecture and network diagram
24Requirements that are identified to protect against the destruction of
information or the software itself are commonly referred to as- Aconfidentiality requirements.
- Bintegrity requirements
- Cavailability requirements.
- Dauthentication requirements
25The amount of time by which business operations need to be restored
to service levels as expected by the business when there is a security
breach or disaster is known as- AMaximum Tolerable Downtime (MTD).
- BMean Time Before Failure (MTBF).
- CMinimum Security Baseline (MSB).
- DRecovery Time Objective (RTO).
26The use of an individual’s physical characteristics such as retinal blood
patterns and fingerprints for validating and verifying the user’s identity
if referred to as- Abiometric authentication.
- Bforms authentication.
- Cdigest authentication.
- Dintegrated authentication.
27Which of the following policies is MOST likely to include the
following requirement? “All software processing financial transactions
need to use more than one factor to verify the identity of the entity
requesting access””- AAuthorization
- BAuthentication.
- CAuditing
- DAvailability
28A means of restricting access to objects based on the identity of subjects
and/or groups to which they belong, as mandated by the requested
resource owner is the definition of- ANon-discretionary Access Control (NDAC).
- BDiscretionary Access Control (DAC).
- CMandatory Access Control (MAC).
- DRole based Access Control.
29Requirements which when implemented can help to build a history of
events that occurred in the software are known as- Aauthentication requirements.
- Barchiving requirements.
- Caccountability requirements.
- Dauthorization requirements.
30 Which of the following is the PRIMARY reason for an application to
be susceptible to a Man-in-the-Middle (MITM) attack?- AImproper session management
- BLack of auditing
- CImproper archiving
- DLack of encryption
31The process of eliciting concrete software security requirements from
high level regulatory and organizational directives and mandates in
the requirements phase of the SDLC is also known as- Athreat modeling.
- Bpolicy decomposition.
- Csubject-object modeling
- Dmisuse case generation.
32The FIRST step in the Protection Needs Elicitation (PNE) process is
to- Aengage the customer
- Bmodel information management
- Cidentify least privilege applications
- Dconduct threat modeling and analysis
33A Requirements Traceability Matrix (RTM) that includes security
requirements can be used for all of the following except- Aensuring scope creep does not occur
- Bvalidating and communicating user requirements
- Cdetermining resource allocations
- Didentifying privileged code sections
34Parity bit checking mechanisms can be used for all of the following
except- AError detection
- BMessage corruption.
- CIntegrity assurance
- DInput validation
35Which of the following is an activity that can be performed to clarify
requirements with the business users using diagrams that model the
expected behavior of the software?- AThreat modeling
- BUse case modeling
- CMisuse case modeling
- DData modeling
36Which of the following is LEAST LIKELY to be identified by misuse
case modeling?- ARace conditions
- BMis-actors
- CAttacker’s perspective
- DNegative requirements
37 Data classification is a core activity that is conducted as part of which
of the following?- AKey Management Lifecycle
- BInformation Lifecycle Management
- CConfiguration Management
- DProblem Management
38Web farm data corruption issues and card holder data encryption
requirements need to be captured as part of which of the following
requirements?- AIntegrity.
- BEnvironment.
- CInternational.
- DProcurement.
39When software is purchased from a third party instead of being built
in-house, it is imperative to have contractual protection in place and
have the software requirements explicitly specified in which of the
following?- AService Level Agreements (SLA).
- BNon-Disclosure Agreements (NDA)
- CNon-compete Agreements
- DProject plan.
40When software is able to withstand attacks from a threat agent and
not violate the security policy it is said to be exhibiting which of the
following attributes of software assurance?- AReliability
- BResiliency.
- CRecoverability
- DRedundancy.
41 Infinite loops and improper memory calls are often known to cause
threats to which of the following?- AAvailability.
- BAuthentication.
- CAuthorization.
- DAccountability.
42Which of the following is used to communicate and enforce availability
requirements of the business or client?- ANon-Disclosure Agreement (NDA).
- BCorporate Contract.
- CService Level Agreements (SLA).
- DThreat model.
43Software security requirements that are identified to protect against
disclosure of data to unauthorized users is otherwise known as- Aintegrity requirements
- Bauthorization requirements
- Cconfidentiality requirements.
- Dnon-repudiation requirements.
44The requirements that assure reliability and prevent alterations are to be
identified in which section of the software requirements specifications
(SRS) documentation?- AConfidentiality.
- BIntegrity.
- CAvailability.
- DAccountability
45Which of the following is a covert mechanism that assures
confidentiality?- AEncryption.
- BSteganography.
- CHashing.
- DMasking.
46As a means to assure confidentiality of copyright information, the
security analyst identifies the requirement to embed information
insider another digital audio, video or image signal. This is commonly
referred to as- AEncryption.
- BHashing.
- CLicensing
- DWatermarking.
47Checksum validation can be used to satisfy which of the following
requirements?- AConfidentiality.
- BIntegrity.
- CAvailability
- DAuthentication.
48A Requirements Traceability Matrix (RTM) that includes security
requirements can be used for all of the following EXCEPT- AEnsure scope creep does not occur
- BValidate and communicate user requirements
- CDetermine resource allocations
- DIdentifying privileged code sections
49Domain 3
During which phase of the software development lifecycle (SDLC) is
threat modeling initiated?- ARequirements analysis
- BDesign
- CImplementation
- DDeployment
50Certificate Authority, Registration Authority, and Certificate
Revocation Lists are all part of which of the following?- AAdvanced Encryption Standard (AES)
- BSteganography
- CPublic Key Infrastructure (PKI)
- DLightweight Directory Access Protocol (LDAP)
51The use of digital signatures has the benefit of providing which of the
following that is not provided by symmetric key cryptographic design?- ASpeed of cryptographic operations
- BConfidentiality assurance
- CKey exchange
- DNon-repudiation
52When passwords are stored in the database, the best defense against
disclosure attacks can be accomplished using- Aencryption.
- Bmasking.
- Chashing.
- Dobfuscation.
53Nicole is part of the ‘author’ role as well as she is included in the
‘approver’ role, allowing her to approve her own articles before it is
posted on the company blog site. This violates the principle of- Aleast privilege.
- Bleast common mechanisms.
- Ceconomy of mechanisms.
- Dseparation of duties
54The primary reason for designing Single Sign On (SSO) capabilities is
to- Aincrease the security of authentication mechanisms
- Bsimplify user authentication.
- Chave the ability to check each access request
- Dallow for interoperability between wireless and wired networks.
55Database triggers are PRIMARILY useful for providing which of the
following detective software assurance capability?- AAvailability
- BAuthorization.
- CAuditing.
- DArchiving
56During a threat modeling exercise, the software architecture is reviewed
to identify- Aattackers.
- Bbusiness impact.
- Ccritical assets
- Dentry points.
57A Man-in-the-Middle (MITM) attack is PRIMARILY an expression
of which type of the following threats?- ASpoofing
- BTampering
- CRepudiation
- DInformation disclosure
58IPSec technology which helps in the secure transmission of information
operates in which layer of the Open Systems Interconnect (OSI) model?- ATransport.
- BNetwork
- CSession.
- DApplication.
59When internal business functionality is abstracted into service oriented
contract based interfaces, it is PRIMARILY used to provide for- Ainteroperability.
- Bauthentication.
- Cauthorization.
- Dinstallation ease.
60At which layer of the Open Systems Interconnect (OSI) model must
security controls be designed to effectively mitigate side channel attacks?- ATransport
- BNetwork
- CData link
- DPhysical
61Which of the following software architectures is effective in distributing
the load between the client and the server, but since it includes the
client to be part of the threat vectors it increases the attack surface?- ASoftware as a Service (SaaS).
- BService Oriented Architecture (SOA).
- CRich Internet Application (RIA).
- DDistributed Network Architecture (DNA).
62When designing software to work in a mobile computing environment,
the Trusted Platform Module (TPM) chip can be used to provide
which of the following types of information?- AAuthorization.
- BIdentification.
- CArchiving
- DAuditing.
63When two or more trivial pieces of information are brought together
with the aim of gleaning sensitive information, it is referred to as what
type of attack?- AInjection.
- BInference.
- CPhishing.
- DPolyinstantiation.
64The inner workings and internal structure of backend databases can be
protected from disclosure using- Atriggers.
- Bnormalization.
- Cviews.
- Dencryption
65Choose the BEST answer. Configurable settings for logging exceptions,
auditing and credential management must be part of- Adatabase views.
- Bsecurity management interfaces.
- Cglobal files.
- Dexception handling.
66The token that is PRIMARILY used for authentication purposes in a
Single Sign (SSO) implementation between two different companies is- AKerberos
- BSecurity Assert Markup Language (SAML)
- CLiberty alliance ID-FF
- DOne Time password (OTP)
67Syslog implementations require which additional security protection
mechanisms to mitigate disclosure attacks?- AUnique session identifier generation and exchange.
- BTransport Layer Security.
- CDigital Rights Management (DRM)
- DData Loss Prevention,
68Rights and privileges for a file can be granularly granted to each client
using which of the following technologies- AData Loss Prevention (DLP).
- BSoftware as a Service (SaaS)
- CFlow control
- DDigital Rights Management (DRM)
69Which of the following is known to circumvent the ring protection
mechanisms in operating systems?- ACross Site Request Forgery (CSRF)
- BCoolboot
- CSQL Injection
- DRootkit
70When the software is designed using Representational State Transfer
(REST) architecture, it promotes which of the following good
programming practices?- AHigh Cohesion
- BLow Cohesion
- CTight Coupling
- DLoose Coupling
71. Which of the following components of the Java architecture is primarily
responsible to ensure type consistency, safety and assure that there are
no malicious instructions in the code?- AGarbage collector
- BClass Loader
- CBytecode Verfier
- DJava Security Manager
72The primary security concern when implementing cloud applications
is related to- AInsecure APIs
- BData leakage and/or loss
- CAbuse of computing resources
- DUnauthorized access
73The predominant form of malware that infects mobile apps is
- AVirus
- BRansomware
- CWorm
- DSpyware
74Most Supervisory Control And Data Acquisition (SCADA) systems
are susceptible to software attacks because- Athey were not initially implemented with security in mind
- Bthe skills of a hacker has increased significantly
- Cthe data that they collect are of top secret classification
- Dthe firewalls that are installed in front of these devices have been
breached.
75Domain 4
Software developers writes software programs PRIMARILY to- Acreate new products
- Bcapture market share
- Csolve business problems
- Dmitigate hacker threats
76The process of combining necessary functions, variables and
dependency files and libraries required for the machine to run the
program is referred to as- Acompilation
- Binterpretation
- Clinking
- Dinstantiation
77Which of the following is an important consideration to manage
memory and mitigate overflow attacks when choosing a programming
language?- ALocality of reference
- BType safety
- CCyclomatic complexity
- DParametric polymorphism
78Assembly and machine language are examples of
- Anatural language
- Bvery high-level language (VHLL)
- Chigh-level language (HLL)
- Dlow-level language
79Using multifactor authentication is effective in mitigating which of the
following application security risks?- AInjection flaws
- BCross-Site Scripting (XSS)
- CBuffer overflow
- DMan-in-the-Middle (MITM)
80Impersonation attacks such as Man-in-the-Middle (MITM) attacks in
an Internet application can be BEST mitigated using proper- AConfiguration Management.
- BSession Management.
- CPatch Management.
- DException Management.
81Implementing Completely Automated Public Turing test to tell
Computers and Humans Apart (CAPTCHA) protection is a means
of defending against- ASQL Injection
- BCross-Site Scripting (XSS)
- CCross-Site Request Forgery (CSRF)
- D. Insecure cryptographic storage
82The findings of a code review indicate that cryptographic operations
in code use the Rijndael cipher, which is the original publication of
which of the following algorithms?- ASkipjack
- BData Encryption Standard (DES)
- CTriple Data Encryption Standard (3DES)
- DAdvanced Encryption Standard (AES)
83Which of the following transport layer technologies can BEST mitigate
session hijacking and replay attacks in a local area network (LAN)?- AData Loss Prevention (DLP)
- BInternet Protocol Security (IPSec)
- CSecure Sockets Layer (SSL)
- DDigital Rights Management (DRM)
84Verbose error messages and unhandled exceptions can result in which
of the following software security threats?- ASpoofing
- BTampering
- CRepudiation
- DInformation disclosure
85Code signing can provide all of the following EXCEPT
- AAnti-tampering protection
- BAuthenticity of code origin
- CRuntime permissions for code
- DAuthentication of users
86When an attacker uses delayed error messages between successful and
unsuccessful query probes, he is using which of the following side
channel techniques to detect injection vulnerabilities?- ADistant observation
- BCold boot
- CPower analysis
- DTiming
87When the code is not allowed to access memory at arbitrary locations
that is out of range of the memory address space that belong to the
object’s publicly exposed fields, it is referred to as which of the following
types of code?- AObject code
- BType safe code
- CObfuscated code
- DSource code
88When the runtime permissions of the code are defined as security
attributes in the metadata of the code, it is referred to as- Aimperative syntax security
- Bdeclarative syntax security
- Ccode signing
- Dcode obfuscation
89When an all-or-nothing approach to code access security is not possible
and business rules and permissions need to be set and managed more
granularly inline code functions and modules, a programmer can
leverage which of the following?- ACryptographic agility
- BParametric polymorphism
- CDeclarative security
- DImperative security
90An understanding of which of the following programming concepts
is necessary to protect against memory manipulation buffer overflow
attacks? Choose the BEST answer.- AError handling
- BException management
- CLocality of reference
- DGenerics
91Exploit code attempt to take control of dangling pointers which
- Aare references to memory locations of destroyed objects.
- Bis the non-functional code that that is left behind in the source.
- Cis the payload code that the attacker uploads into memory to
execute. - Dare references in memory locations that are used prior to being
initialized.
92Which of the following is a feature of most recent operating systems
(OS) that makes it difficult for an attacker to guess the memory address
of the program as it makes the memory address different each time the
program is executed?- AData Execution Prevention (DEP)
- BExecutable Space Protection (ESP)
- CAddress Space Layout Randomization (ASLR)
- DSafe Security Exception Handler (/SAFESEH)
93When the source code is made obscure using special programs in order
to make the readability of the code difficult when disclosed, the code is
also known as- Aobject code
- Bobfuscated code.
- Cencrypted code.
- Dhashed code.
94The ability to track ownership, changes in code and rollback abilities is
possible because of which of the following configuration management
processes?- AVersion control
- BPatching
- CAudit logging
- DChange control
95The MAIN benefit of statically analyzing code is that
- Aruntime behavior of code can be analyzed.
- Bbusiness logic flaws are more easily detectable.
- Cthe analysis is performed in a production or production-like
environment - Derrors and vulnerabilities can be detected earlier in the life cycle.
96Cryptographic protection includes all of the following EXCEPT
- Aencryption of data when it is processed.
- Bhashing of data when it is stored.
- Chiding of data within other media objects when it is transmitted.
- Dmasking of data when it is displayed.
97Replacing the Primary Account Number (PAN) with random or
pseudo-random symbols that are uniquely identifiable and still assuring
privacy is also known as- AFuzzing
- BTokenization
- CEncoding
- DCanonicalization
98Which of the following is an implementation of the principle of least
privilege?- ASandboxing
- BTokenization
- CVersioning
- D. Concurrency
99Domain 5
The ability of the software to restore itself to expected functionality
when the security protection that is built in is breached is also known
as- Aredundancy.
- Brecoverability.
- Cresiliency.
- Dreliability.
100In which of the following software development methodologies does
unit testing enable collective code ownership and is critical to assure
software assurance?- AWaterfall
- BAgile
- CSpiral
- DPrototyping
101Which of the secure design principles is promoted when test harnesses
are used?- ALeast privilege
- BSeparation of duties
- CLeveraging existing components
- DPsychological acceptability
102The use of IF-THEN rules is characteristic of which of the following
types of software testing?- ALogic
- BScalability
- CIntegration
- DUnit
103The implementation of secure features such as complete mediation and
data replication needs to undergo which of the following types of test
to ensure that the software meets the service level agreements (SLA)?- AStress
- BUnit
- CIntegration
- DRegression
104Tests that are conducted to determine the breaking point of the software
after which the software will no longer be functional is characteristic
of which of the following types of software testing?- ARegression
- BStress
- CIntegration
- DSimulation
105Which of the following tools or techniques can be used to facilitate the
white box testing of software for insider threats?- ASource code analyzers
- BFuzzers
- CBanner grabbing software
- DScanners
106When very limited or no knowledge of the software is made known to
the software tester before she can test for its resiliency, it is characteristic
of which of the following types of security tests?- AWhite box
- BBlack box
- CClear box
- DGlass box
107 Penetration testing must be conducted with properly defined
- Arules of engagement.
- Brole based access control mechanisms
- Cthreat models.
- Duse cases
108Testing for the randomness of session identifiers and the presence of
auditing capabilities provides the software team insight into which of
the following security controls?- AAvailability
- BAuthentication.
- CNon-repudiation.
- DAuthorization.
109Disassemblers, debuggers and decompilers can be used by security
testers to PRIMARILY determine which of the following types of
coding vulnerabilities?- AInjection flaws
- BLack of reverse engineering protection.
- CCross-Site Scripting.
- DBroken session management.
110When reporting a software security defect in the software, which of
the following also needs to be reported so that variance from intended
behavior of the software can be determined?- ADefect identifier
- BTitle
- CExpected results
- DTester name
111An attacker analyzes the response from the web server which indicates
that its version is the Microsoft Internet Information Server 6.0
(Microsoft-IIS/6.0), but none of the IIS exploits that the attacker
attempts to execute on the web server are successful. Which of the
following is the MOST probable security control that is implemented?- AHashing
- BCloaking
- CMasking
- DWatermarking
112Smart fuzzing is characterized by injecting
- Atruly random data without any consideration for the data
structure. - Bvariations of data structures that are known.
- Cdata that get interpreted as commands by a backend interpreter
- Dscripts that are reflected and executed on the client browser.
- Atruly random data without any consideration for the data
113Which of the following is the MOST important to ensure, as part
of security testing, when the software is forced to fail x? Choose the
BEST answer.- ANormal operational functionality is not restored automatically.
- BAccess to all functionality is denied.
- CConfidentiality, integrity and availability are not adversely
impacted. - DEnd users are adequately trained and self help is made available
for the end user to fix the error on their own.
114Timing and synchronization issues such as race conditions and
resource deadlocks can be MOST LIKELY identified by which of the
following tests? Choose the BEST answer.- AIntegration
- BStress
- CUnit
- DRegression
115The PRIMARY objective of resiliency testing of software is to
determine- Athe point at which the software will break.
- Bif the software can restore itself to normal business operations.
- Cthe presence and effectiveness of risk mitigation controls.
- Dhow a blackhat would circumvent access control mechanisms.
116The ability of the software to withstand attempts of attackers who
intend to breach the security protection that is built in is also known as- Aredundancy.
- Brecoverability.
- Cresiliency.
- Dreliability.
117Drivers and stub based programming are useful to conduct which of
the following tests?- AIntegration
- BRegression
- CUnit
- DPenetration
118Assurance that the software meets the expectations of the business as
defined in the service level agreements (SLAs) can be demonstrated by
which of the following types of tests?- AUnit
- BIntegration
- CPerformance
- DRegression
119Vulnerability scans are used to
- Ameasure the resiliency of the software by attempting to exploit
weaknesses. - Bdetect the presence of loopholes and weaknesses in the software.
- Cdetect the effectiveness of security controls that are implemented
in the software. - Dmeasure the skills and technical know-how of the security tester.
- Ameasure the resiliency of the software by attempting to exploit
120In the context of test data management, when a transaction which
serves no business purpose is tested, it is referred to as what kind of
transaction?- ANon-synthetic
- BSynthetic
- CUseless
- DDiscontinuous
121As part of the test data management strategy, when a criteria is applied
to export selective information from a production system to the test
environment, it is also referred to as- ASubletting
- BFiltering
- CValidation
- DSubsetting
122Domain 6
Your organization has the policy to attest the security of any software
that will be deployed into the production environment. A third party
vendor software is being evaluated for its readiness to be deployed.
Which of the following verification and validation mechanism can be
employed to attest the security of the vendor’s software?- ASource code review
- BThreat modeling the software
- CBlack box testing
- DStructural analysis
123To meet the goals of software assurance, when accepting software, the
acquisition phase MUST include processes to- Averify that installation guides and training manuals are provided.
- Bassess the presence and effectiveness of protection mechanisms.
- Cvalidate vendor’s software products.
- Dassist the vendor in responding to the request for proposals.
124The process of evaluating software to determine whether the products
of a given development phase satisfies the conditions imposed at the
start of the phase is referred to as- Averification
- Bvalidation
- Cauthentication
- Dauthorization
125When verification activities are used to determine if the software is
functioning as it is expected to, it provides insight into which of the
following aspects of software assurance?- ARedundancy
- BReliability
- CResiliency
- DRecoverability
126When procuring software the purchasing company can request the
evaluation assurance levels (EALs) of the software product which is
determined using which of the following evaluation methodologies?- AOperationally Critical Assets Threats and Vulnerability Evaluation®
(OCTAVE) - BSecurity Quality Requirements Engineering (SQUARE)
- CCommon Criteria
- DComprehensive, Lightweight Application Security Process
(CLASP)
- AOperationally Critical Assets Threats and Vulnerability Evaluation®
127The FINAL activity in the software acceptance process is the go/no go
decision that can be determined using- Aregression testing.
- Bintegration testing.
- Cunit testing.
- Duser acceptance testing.
128Management’s formal acceptance of the system after an understanding
of the residual risks to that system in the computing environment is
also referred to as- Apatching.
- Bhardening.
- Ccertification.
- Daccreditation.
129You determine that a legacy software running in your computing
environment is susceptible to Cross Site Request Forgery (CSRF)
attacks because of the way it manages sessions. The business has the
need to continue use of this software but you do not have the source
code available to implement security controls in code as a mitigation
measure against CSRF attacks. What is the BEST course of action to
undertake in such a situation?- AAvoid the risk by forcing the business to discontinue use of the
software. - BAccept the risk with a documented exception.
- CTransfer the risk by buying insurance.
- DIgnore the risk since it is legacy software
- AAvoid the risk by forcing the business to discontinue use of the
130As part of the accreditation process, the residual risk of a software
evaluated for deployment must be accepted formally by the- Aboard members and executive management
- Bbusiness owner.
- Cinformation technology (IT) management
- Dsecurity organization
131Domain 7
When software that worked without any issues in the test environments
fails to work in the production environment, it is indicative of- Ainadequate integration testing
- Bincompatible environment configurations.
- Cincomplete threat modeling.
- Dignored code review
132Which of the following is not characteristic of good security metrics?
- AQuantitatively expressed
- BObjectively expressed
- CContextually relevant
- DCollected manually
133Removal of maintenance hooks, debugging code and flags, and
unneeded documentation before deployment are all examples of
software- Ahardening
- Bpatching.
- Creversing.
- Dobfuscation.
134Which of the following has the goal of ensuring that the resiliency
levels of software is always above the acceptable risk threshold as
defined by the business post deployment?- AThreat modeling.
- BCode review.
- CContinuous monitoring.
- DRegression testing.
135Logging application events such as failed login attempts, sales price
updates and user roles configuration for audit review at a later time is
an example of which of the following type of security control?- APreventive
- BCorrective
- CCompensating
- DDetective
136When a compensating control is to be used, the Payment Card Industry
Data Security Standard (PCI DSS) prescribes that the compensating
control must meet all of the following guidelines EXCEPT- AMeet the intent and rigor of the original requirement.
- BProvide an increased level of defense than the original requirement
- CBe implemented as part of a defense in depth measure.
- DMust commensurate with additional risk imposed by not adhering
to the requirement
137Versioning, back-ups, check-in and check-out practices are all important
components of- APatch management
- BRelease management
- CProblem management
- DIncident management
138Software that is deployed in a high trust environment such as the
environment within the organizational firewall when not continuously
monitored is MOST susceptible to which of the following types of
security attacks? Choose the BEST answer.- ADistributed Denial of Service (DDoS)
- BMalware
- CLogic Bombs
- DDNS poisoning
139Bastion host systems can be used to continuously monitor the security
of the computing environment when it is used in conjunction with
intrusion detection systems (IDS) and which other security control?- AAuthentication.
- BAuthorization.
- CArchiving.
- DAuditing.
140The FIRST step in the incident response process of a reported breach
is to- Anotify management of the security breach.
- Bresearch the validity of the alert or event further
- Cinform potentially affected customers of a potential breach.
- Dconduct an independent third party evaluation to investigate the
reported breach.
141Which of the following is the BEST recommendation to champion
security objectives within the software development organization?- AInforming the developers that they could lose their jobs if their
software is breached. - BInforming management that the organizational software could
be hacked. - CInforming the project team about the recent breach of the
competitor’s software. - DInforming the development team that there should be no injection
flaws in the payroll application.
- AInforming the developers that they could lose their jobs if their
142Which of the following independent process provides insight into the
presence and effectiveness of security and privacy controls and is used
to determine the organization’s compliance with the regulatory and
governance (policy) requirements?- APenetration testing
- BAudits
- CThreat modeling
- DCode review
143The process of using regular expressions to parse audit logs into
information that indicate security incidents is referred to as- Acorrelation.
- Bnormalization.
- Ccollection.
- Dvisualization.
144The FINAL stage of the incident management process is to
- Adetection.
- Bcontainment.
- Ceradication
- Drecovery
145Problem management aims to improve the value of Information
Technology to the business because it improves service by- Arestoring service to the expectation of the business user
- Bdetermining the alerts and events that need to be continuously
monitored. - Cdepicting incident information in easy to understand user friendly
format. - Didentifying and eliminating the root cause of the problem
146The process of releasing software to fix a recently reported vulnerability
without introducing any new features or changing hardware
configuration is referred to as- Aversioning.
- Bhardening.
- Cpatching.
- Dporting.
147Fishbone diagramming is a mechanism that is PRIMARILY used for
which of the following processes?- AThreat modeling
- BRequirements analysis.
- CNetwork deployment.
- DRoot cause analysis.
148As a means to assure the availability of the existing software functionality
after the application of a patch, the patch need to be tested for- Athe proper functioning of new features
- Bcryptographic agility
- Cbackward compatibility.
- Dthe enabling of previously disabled services
149Which of the following policies needs to be established to securely
dispose software and associated data and documents?- AEnd-of-life.
- BVulnerability management.
- CPrivacy.
- DData classification.
150Discontinuance of a software with known vulnerabilities with a newer
version is an example of risk- Amitigation.
- Btransference.
- Cacceptance.
- Davoidance.
151Printer ribbons, facsimile transmissions and printed information when
not securely disposed are susceptible to disclosure attacks by which of
the following threat agents? Choose the BEST answer.- AMalware
- BDumpster divers
- CSocial engineers
- DScript kiddies.
152System resources can be protected from malicious file execution attacks
by uploading the user supplied file and running it in which of the
following environment?- AHoneypot
- BSandbox
- CSimulated
- DProduction
153As a means to demonstrate the improvement in the security of code
that is developed, one must compute the relative attack surface quotient
(RASQ)- Aat the end of development phase of the project
- Bbefore and after the code is implemented.
- Cbefore and after the software requirements are complete.
- Dat the end of the deployment phase of the project.
154Modifications to data directly in the database by developers must be
prevented by- Aperiodically patching database servers
- Bimplementing source code version control.
- Clogging all database access requests.
- Dproper change control management.
155Which of the following documents is the BEST source to contain
damage and which needs to be referred to and consulted with upon
the discovery of a security breach?- ADisaster Recovery Plan.
- BProject Management Plan.
- CIncident Response Plan.
- DQuality Assurance and Testing Plan.
156Domain 8
The increased need for security in the software supply chain is
PRIMARILY attributed to- Acessation of development activities within a company
- Bincrease in the number of foreign trade agreements
- Cincidences of malicious code and logic found in acquired software
- Ddecrease in the trust of consumers on software developed within
a company.
157Which phase of the acquisition life cycle involves the issuance of
advertisements to source and evaluate suppliers?- AContracting
- BPlanning
- CDevelopment
- DDelivery (Handover
158Predictable execution means that the software demonstrates all the
following qualities EXCEPT?- AAuthenticity
- BConformance
- CAuthorization
- DTrustworthiness
159Which of the following is a process threat in the software supply chain?
- ACounterfeit software
- BInsecure code transfer
- CSubornation
- DPiracy
160In the context of the software supply chain, the principle of persistent
protection is also known as- AEnd-to-end encryption
- BLocation agnostic protection
- CLocality of reference
- DCryptographic agility
161In pre-qualifying a supplier, which of the following must be assessed to
ensure that the supplier can provide timely updates and hotfixes when
an exploitable vulnerability in their software is reported?- AForeign ownership and control or influence
- BSecurity track record
- CSecurity knowledge of the supplier’ s personnel
- DCompliance with security policies, regulatory and privacy
requirements.
162Which of the following can provide insight into the effectiveness and
efficiencies of the supply chain processes as it pertains to assuring trust
and software security?- AKey Performance Indicators (KPI)
- BRelative Attack Surface Quotient (RASQ)
- CMaximum Tolerable Downtime (MTD)
- DRequirements Traceability Matrix (RTM)
163Which of the following contains the security requirements and the
evidence needed to prove that the acquirer requirements are met as
expected?- ASoftware Configuration Management Plan
- BMinimum Security Baseline
- CService Level Agreements
- DAssurance Plan
164The difference between disclaimer-based protection and contractsbased
is that- AContracts-based protection is mutual.
- BDisclaimer-based protection is mutual
- CContracts-based protection is done by one-sided notification of
terms - DDisclaimer-based protection is legally binding.
165Software programs, database models and images on a website can be
protected using which of the following legal instrument?- APatents
- BCopyright
- CTrademarks
- DTrade secret
166You find out that employees in your company have been downloading
software files and sharing them using peer-to-peer based torrent
networks. These software files are not free and need to be purchase
from their respective manufacturers. You employee are violating- ATrade secrets
- BTrademarks
- CPatents
- DCopyrights
167Which of the following legal instruments assures the confidentiality
of software programs, processing logic, database schema and internal
organizational business processes and client lists?- AStandards
- BNon-Disclosure Agreements (NDA)
- CService Level Agreements (SLA)
- DTrademarks
168When source code of Commercially Off-The-Shelf (COTS) software
is escrowed and released under a free software or open source license
when the original developer (or supplier) no longer continues to develop
that software, that software is referred to as- ATrialware
- BDemoware
- CRansomware
- DFreeware
169Improper implementation of validity periods using length-of-use
checks in code can result in which of the following types of security
issues for legitimate users?- ATampering
- BDenial of Service
- CAuthentication bypass
- DSpoofing
170Your organization’s software is published as a trial version without any
restricted functionality from the paid version. Which of the following
MUST be designed and implemented to ensure that customers who
have not purchased the software are limited in the availability of the
software?- ADisclaimers
- BLicensing
- CValidity periods
- DEncryption
171When must the supplier inform the acquirer of any applicable export
control and foreign trade regulatory requirements in the countries of
export and import?- ABefore delivery (handover)
- BBefore code inspection.
- CAfter deployment.
- DBefore retirement.
172The disadvantage of using open source software from a security
standpoint is- AOnly the original publisher of the source code can modify the
code - BOpen source software is not supported and maintained by mature
companies or communities. - CThe attacker can look into the source code to determine its
exploitability. - DOpen source software can only be purchased using a piece-meal
approach.
- AOnly the original publisher of the source code can modify the
173Which of the following is the most important security testing process
that validates and verifies the integrity of software code, components
and configurations, in a software security chain?- AThreat modeling
- BFuzzing
- CPenetration testing
- DCode review
174Which of the following is LEAST likely to be detected using a code
review process?- ABackdoors
- BLogic Bombs
- CLogic Flaws
- DTrojan horses
175Which of the following security principle is LEAST related to the
securing of code repositories?- ALeast privilege
- BAccess Control
- CAuditing
- DOpen Design
176The integrity of build tools and the build environment is necessary to
protect against- Aspoofing
- Btampering
- Cdisclosure
- Ddenial of service
177Which of the following kind of security testing tool detects the presence
of vulnerabilities through disassembly and pattern recognition?- ASource code scanners
- BBinary code scanners
- CByte code scanners
- DCompliance validators
178When software is developed by multiple suppliers, the genuineness of
the software can be attested using which of the following processes?- ACode review
- BCode signing
- CEncryption
- DCode scanning
179Which of the following must be controlled during handoff of software
from one supplier to the next, so that no unauthorized tampering of
the software can be done?- AChain of custody
- BSeparation of privileges
- CSystem logs
- DApplication data
180Which of the following risk management concepts is demonstrated
when using code escrows?- AAvoidance
- BTransference
- CMitigation
- DAcceptance
181Which of the following types of testing is crucial to conduct to
determine single points of failure in a System-of-systems (SoS)?- AUnit
- BIntegration
- CRegression
- DLogic
182When software is handed from one supplier to the next, the following
operational process needs to be in place so that the supplier from whom
the software is acquirer can no longer modify the software?- ARuntime integrity assurance
- BPatching
- CTermination Access Control
- DCustom Code Extension Checks
Informationen
- Beschreibung
- Computer Science Quiz am Secure Software Development Final , erstellt von Thomas Kreuser am 18/04/2017.
- Autor
- Thomas Kreuser
- Sprache
- English
- Aufrufe
- 3.813
- Verlauf
- Erstellt am 18 Apr 2017 · aktualisiert am 30 Apr 2017
- Schlagwörter
- Bewertung
- 5,0 von 5 · 1 Bewertung Bewerte dieses Quiz