Quiz
Secure Software Concepts
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (60)
1Which access control mechanism provides the owner of an object the opportunity to determine the access control permissions for other subjects?
- ADiscretionary
- BMandatory
- CRole-Based
- DToken-Base
2The elements UDI and CDI are associated with which access control model?
- AClark-Wilson Model
- BMandatory Access Control
- CBib Integrity Model
- DBell-LaPudula Confidentiality Model
3The concept of separating elements of a system to prevent inadvertent information sharing is?
- ALeast Common Mechanism
- BLeverage Existing Components
- CSeparation of Duties
- DWeakest Link
4Which of the following is true about the Biba Integrity Model?
- ANo write up, no read down
- BNo read up, no write down
- CIt is described by the simple security rule
- DIt uses the high-water-mark principle
5The concept of preventing a subject from denying a previous action with an object in a system is a description of?
- ANon-Repudiation
- BDefense in Depth
- CConstrained Data Item (UDI)
- DSimple Security Rule
6What was described in the chapter as being essential in order to implement discretionary access controls?
- AObject Owner-Defined Security Access
- BCertificates
- CLabels
- DSecurity Classifications
7The CIA of security includes:
- AConfidentiality, Integrity, Availability
- BConfidentiality, Integrity, Authentication
- CCertificates, Integrity, Availability
- DConfidentiality, Inspection, Authentication
8Complete mediation is an approach to security that includes:
- AA security design that cannot be bypassed or circumvented.
- BProtect systems and networks by using defense in depth.
- Cthe use of interlocking rings of trust to ensure protection to data elements.
- DThe use of access control lists to enforce security rules.
9The fundamental approach to security in which an object has only the necessary rights and privileges to perform its task with no additional permissions is a description of:
- ALeast Privilege
- BLayered Security
- CRole-Based Security
- DClark-Wilson Model
10Which access control technique relies on a set of rules to determine whether access to an object will be granted or not?
- ARule-Based Access Control
- BRole-Based Access Control
- CObject and Rule Instantiation Access Control
- DDiscretionary Access Control
11The security principle that ensures that no critical function can be executed by any single individual (by dividing the function into multiple tasks that can't all be executed by the same individual) is known as:
- ASeparation of Duties
- BDiscretionary Access Control
- CSecurity Through Obscurity
- DImplicit Deny
12The ability of a subject to interact with an object describes:
- AAccess
- BConfidentiality
- CMutual Authentication
- DAuthentication
13Open design places the focus of security efforts on:
- AProducing a security mechanism in which its strength is independent of its design
- BOpen-source software components
- CHiding key elements (security through obsurity)
- DProprietary algorithms
14The security principle of fail-safe is related to:
- AException Management
- BSession Management
- CLeast Privilege
- DSingle Point of Failure
15Using the principle of keeping things simple related to:
- AEconomy of Mechanism
- BLayered Security
- CSimple Security Rule
- DImplementing Least Privilege for Access Control
16Of the following, which is not a class of controls?
- APhysical
- BInformative
- CTechnical
- DAdministrative
17Log file analysis is a form of what type of control?
- APreventive
- BDetective
- CCorrective
- DCompensating
18To calculate ALE, you need?
- ASLE, asset value
- BARO, asset vale
- CSLE, ARO
- DAsset value, exposure factor
19Risk that remains after the application of controls is referred to as
- AAcceptable risk
- BBusiness risk
- CSystematic risk
- DResidual risk
20Calculate ALE for asset value = $1000, exposure factor = 0.75, ARO = 2
- A$1500
- B$15000
- C$375
- DCannot be determined without additional information
21Single loss expectancy (SLE) can be best be defined by which of the following equations?
- ASLE = asset value * exposure factor
- BSLE = asset value * annualized rate of occurrence (ALE)
- CSLE = annualized loss expectancy (ALE) * annualized rate of occurrence (ARO)
- DSLE = annualized loss expectancy (ALE) * exposure factor
22Which of the following describes the qualitative risk management?
- AThe process of using equations to determine impacts of risks to an enterprise
- BThe use of experience and knowledge in the determination of single loss expectancies
- CThe process of objectively determining the impact of an event that affects a project, program, or business
- DThe process of subjectively determining the impact of an event that affects a project, program, or business.
23Risk is defined as:
- AAny characteristic of an assert than can be exploited by a threat to cause harm.
- BAny circumstance or even with the potential to cause harm to an assert.
- CThe overall decision-making process of identifying threats and vulnerabilities and their potential impacts.
- DThe possibility of suffering a loss
24A measure of the magnitude of loss of an assert is:
- AImpact level
- BExposure factor
- CResidual risk
- DLoss factor
25A well-formed risk statement includes all except:
- AAssert
- BImpact
- CFrequency
- DMitigation
26Backups are an example of what type of control?
- APreventive
- BDetective
- CCorrective
- DOperational
27Two controls, each 60% effective in series, are placed to mitigate risk in a system worth $100,000. What is the value of residual risk?
- A$60,000
- B$36,000
- C$40,000
- D$16,000
28Quantitative risk management depends upon:
- AExpert judgement and experience
- BHistorical loss data
- CImpact factor ratio definition
- DExposure ratio
29The following are all examples of technological risk except:
- ARegulatory
- BSecurity
- CChange Management
- DPrivacy
30Which of the following are measured in dollars?
- AExposure factor
- BSLE
- CARO
- DImpact factor
31The primary governing law for federal computer systems is:
- ANIST
- BSarbanes-Oxley
- CFISMA
- DGramm-Leach-Bliley
32Which of the following is a security standard associated with the collection, processing, and storing of credit card data?
- AGramm-Leach-Bliley
- BPCI DSS
- CHIPAA
- DHITECH
33To protect a novel or nonobvious tangible item that will be sold to the public, one can use which of the following
- APatent
- BTrademark
- CTrade secret
- DLicensing
34The organization responsible for the Top Ten list of web application vulnerabilities is:
- ADHS
- BOCTAVE
- CMicrosoft
- DOWASP
35When using customer data as test data for production testing, what process is used to ensure privacy?
- AData anonymization
- BDelinking
- CSafe Harbor principles
- DData disambiguation
36Which of the following is not a common PII element?
- AFull name
- BOrder number
- CIP address
- DDate of birth
37Which of the following is an important element in preventing data breach when backup tapes are lost in transit.
- AService level agreements with a backup storage company
- BUse of split tapes to separate records
- CProprietary backup systems
- DData encryption
38To interface data sharing between U.S. and European firms, one would invoke:
- ASafe Harbor principles
- BData anonymization
- COnward transfer protocol
- DData protection regulation
39Which standard is characterized by Target of Evaluation and Security Targets?
- AISO 9126 Software Quality Assurance
- BISO 15288 Systems and Software Engineering
- CISO 2700X series
- DISO 15408 Common Criteria
40Which of following are mandatory for use in federal systems?
- ANIST SP 800 series
- BFIPS
- CNISTIRs
- DITL security bulletins
41Which of the following is not a framework to improve IT operations
- AITIL
- BCOBIT
- CCOSO
- DOWASP
42The third level of the CMMI model is called:
- AQuantified
- BManaged
- CDefined
- DOptimizing
43Reference monitors must possess all of the following properties except:
- AEfficient
- BComplete mediation
- CTamper-proof
- DVerifiable
44HIPAA and HITECH specify protection of which of the following?
- APHI
- BPII
- CCMMI
- DPFI
45Safe Harbor principles include:
- ANotice, choice, security
- BNonrepudiation, notice, integrity
- CEnforcement, onward transfer, verifiable
- DImpact factor, security access
46Creating a secure development lifecycle involves:
- AAdding security features to the software
- BIncluding threat modeling
- CTraining coders to find and remove security errors
- DModifying the development process, not the software product
47A software product that has security but lack quality can result in:
- AExploitable vulnerabilities
- BUndocumented features that result in undesired behaviors
- CPoor maintainability
- DMissing security elements
48Which of the following is not an attribute of an SDL process?
- AFuzz testing
- BBug bars
- CAuthentication
- DDeveloper security awareness
49Periodic reviews to ensure that security issues are addressed as part of the development process are called
- ASecurity gates
- BSecurity checklist
- CThreat model
- DAttack surface area analysis
50The term DREAD stands for:
- ADamage potential, Recoverability, Exploitability, Asset affected, and Discoverability
- BDamage potential, Reproducibility, Exploitability , Affect user base, and Discoverability
- CDamage potential, Reporducability, External vulnerability, asset Affected, and Discoverability
- DDesign issue, Reproducability, Exploitability, Asset affected, and Discoverability
51The term STRIDE standard for:
- ASpoofing, Tampering, Repudiation, Information disclosure, Denial of Service, Elevation of privilege
- BSpoofing, Tampering, Reproducibility, Information disclosure, Denial of Service, Elevation of privilege
- CSpoofing, Tampering, Reproducibility, Information disclosure, Discoverability, Elevation of privilege
- DSpoofing, Tampering, Repudiation, Information disclosure, Discoverability, Elevation of privilege
52Which of the following describes the purpose of threat modeling?
- AEnumerate threats to the software
- BDefine the correct and secure data flows in a program
- CCommunicate testing requirements to the test team
- DCommunicate threat and mitigation information across the development team
53A tool to examine the vulnerability of input interfaces is:
- AThreat model
- BBug bar
- CAttack surface analysis
- DFuzz testing framework
54A linear model for software development is the:
- AScrum model
- BSpiral model
- CWaterfall model
- DAgile model
55User stories convey high-level user requirements in the:
- AXP model
- BPrototyping model
- CSpiral model
- DWaterfall model
56Bug bars are used to:
- ATrack bugs
- BScore bugs
- CManage bugs
- DAttribute bugs to developers
57The Microsoft SD3+C model is:
- ADesign, Default, Directive, and Concise
- BDesign, Development, Deployment, and Communications
- CDesign, Deployment, Directive, and Concise
- DDesign, Default, Deployment, and Communications
58What is used to ensure that all security activities are being correctly carried out as part of the development process?
- AProject manager judgement
- BSecurity leads
- CSecurity engineers
- DSecurity reviews
59The objectives of an SDL are to achieve all of the following except:
- AReduce the number of security vulnerabilities in software
- BReduce the severity of security vulnerabilities in software
- CEliminate threats to the software
- DDocument a complete understanding of the vulnerabilities in software
60Which is the most common security vulnerability mitigation methodology used in design?
- ADefense in depth
- BSeparation of duties
- CLeast privilege
- DAuditability
Information
- Description
- Quiz on Secure Software Concepts, created by Ashton Norton on 13/03/2017.
- Author
- Ashton Norton
- Language
- English
- Views
- 1
- Tags
- Rating
- No ratings yet Rate this quiz