Quiz
SE
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (85)
1Biometirc methods include:
- Afinger and hand geometry
- Biris and palm imaging
- Cface, retina, and voice recognition
- Dall of these
2Which of the following choices is not one of the 12 practices within the BSIMM?
- ASSDL Touchpoints - Security Testing
- BDeployment - Software Environment
- CIntelligence - Features and Design
- DGovernance - Supplier Mandate
3Which of the following choices is used to evaluate the complete set of circumstances for an activity that is being assessed?
- ACircumstantial Evaluation Process (CEP)
- BTailoring Process Evaluation
- CProcess Protection Profile (PPP)
- DProcess Examination & Tailoring (PET)
4Software assurance is the level of confidence that software functions in the intended manner and is free from vulnerabilities.
- ATrue
- BFalse
5How many control areas exist within the SSE-CMM?
- A22
- B12
- C16
- D10
6-------------is the process of taking a biometric sample from a user.
- Acapture
- Bstoring
- Cverification
- Didentification
7Biometric applications are generally categorized into three classifications:
- Acitizen-dependent, customer-relations, employee-centric
- Bcitizen-facing, customer-facing, employee-facing
- Ccustomer-relations, citizen-facing, sales-dependent
- Dcitizen-facing, government-facing, business-dependent
8Once a biometric is acquired, it must be prepared for comparison. The four basic required tasks include:
- Adata collection, transmission, signal processing, storage, and decision
- Bfeature extraction, quality control, pattern matching, and pattern classification
- Cdata collection, quality control, pattern matching, transmission
- Ddata collection, transmission, signal processing, storage, quality control
9_________ is a relatively stable human physical characteristic.
- Abehavioral characteristic
- Bphysiological characteristic
- Ckeystroke characteristic
- Dtyping characteristic
10What security practice defined at the verification business function level entails a thorough assessment of the specifications created during the design process to ensure consistency with the organization's security expectations?
- ASecurity testing
- BCode review
- CDesign review
- DSecurity requirements
11What process identifies defects and then notifies developers regarding the defects?
- AOperations monitoring
- BVulnerability management
- CGovernance
- DVerification
12Which of the following CMM components signifies the scope, boundaries and intent of each KPA?
- AProcess capability
- BKey practices
- CCommon features
- DGoals
13The PA12 Ensure Quality process exists under what high-level practice area?
- ASecurity Controlled Engineering Practices
- BProject and Organizational Base Practices
- CSecurity Base Practices
- DProject and Security Base Practices
14At what SSE-CMM capability level is the performance of base practices planned and tracked?
- APerformed
- BPredictable
- CEstablished
- DManaged
15Biometric devices, such as finger scanners, consist of:
- Aa reader or scanning device
- Bsoftware
- Ca database
- DA, B, and C
16What area within the SSE-CMM contains 11 high-level control (practice) areas with a number of underlying controls?
- ASecurity Base Practice
- BSecurity Control Base Practice
- CProject and Organizational Base Practice
- DProject Control Base Practice
17Which SAMM worksheet evaluation method evaluates each practice, and assigns scores based on the answers?
- ADetailed
- BLightweight
- CBenign
- DIntrusive
18What two dimensions are used in the SSE-CMM to ensure that the security engineering process is separated from the practices associated with overall good management?
- AEngineering dimension and management dimension
- BDomain dimension and capability dimension
- CDevelopment dimension and security dimension
- DProcess dimension and practice dimension
19Which of the following is not one of the four critical business functions that take part at the top of SAMM's hierarchical model?
- AVerification
- BGovernance
- CAssurance
- DConstruction
20What process area helps to ensure that risk management is properly performed?
- APA15 Monitor and Control Technical Effort
- BPA13 Manage Configurations
- CPA12 Manage Project Risks
- DPA14 Manage Project Risks
21Which of the following statements regarding the use of counterfeit parts is accurate?
- ACounterfeit parts reduce costs and improve product stability
- BCounterfeit parts do not function the same way as authentic parts
- CCounterfeit parts do not affect the security of a product
- DCounterfeit parts can be used to provide a feature that the original manufacturer cannot provide
22Which security practice applied at the SAMM construction business function level identifies potential attacks against an organization's software to help it better understand the risks and improve the ability to manage them?
- AThreat assessment
- BSecure architecture
- CAttack assessment
- DSecurity requirements
23What process area of the SSE-CMM provides training for an organization's security engineering to ensure staff have the necessary knowledge and skills to achieve objectives?
- APA20 Training and Ongoing Skills
- BPA22 Coordinate Training Processes
- CPA23 Organizational Training
- DPA21 Provide Ongoing Skills and Knowledge
24Within the CoBIT model, which security operation maturity level indicates that an operation is applied at the appropriate maturity level within the organization?
- ALevel 2
- BLevel 3
- CLevel 0
- DLevel 1
25According to the BSIMM, what practice typically has the highest maturity level among top organizations?
- ATraining
- BSecurity testing
- CCompliance and policy
- DCode review
26Critical measurement factors which indicate the level of accuracy, or reliability, of any given biometric are ________.
- AFRR
- BFAR
- CNEAR
- DFRR and FAR
27Which of the following job functions is responsible for making key decisions about software and its business requirements?
- ABusiness owners
- BSupport operations
- CProject managers
- DDevelopers
28Which of the following choices represents an example of a high risk?
- AEmployees with limited database access leaving for job opportunities with competitors
- BSensitivity to the risk of disclosure by sales and marketing members who are approached to share information for financial gain
- CThird party intruders that threaten to obtain access to database information and publish it
- DCompetitors that regularly attempt to obtain access to database information or obtain a copy of it
29__ is a user setting for biometric systems operating in the verification or open-set identification (watch list) tasks.
- Arange
- Bthreshold
- Cidentity
- Dfunction
30The five basic components or subsystems of biometric ID systems are:
- Adata collection, transmission, signal processing, storage, decision
- Bfeature extraction, quality control, pattern matching, and pattern classification
- Cdata collection, quality control, pattern matching, transmission
- Ddata collection, transmission, signal processing, storage, quality control
31Bonus question (Answer True)
- ATrue
- BFalse
32Which of the four critical business functions includes processes and an activity related to how an organization defines goals and creates software within development projects?
- AGovernance
- BVerification
- CDeployment
- DConstruction
33Which of the SSE-CMM's capability levels is similar to the CMMI's Defined Level?
- AEstablished
- BManaged
- COptimizing
- DPredictable
34What BSIMM practice improves the skills of the people most closely associated with the software lifecycle?
- ATraining
- BCompliance & Policy
- CAttack Models
- DStrategy & Metrics
35What is the purpose of the software quality assurance (SQA) process?
- AEnsure that products are built with a high level of integrity
- BEstablish and maintain integrity of software and make it available to concerned parties
- CDevelop and maintain records of information produced by any of the other processes.
- DEnsure that software products and processes comply with predefined provisions and plans
36What process area defines the plans that guide a project, which outline scheduling, costing, controlling, tracking, and negotiating technical work involved in system engineering?
- APA13 Manage Configuration
- BPA16 Plan Technical Effort
- CPA12 Project Planning
- DPA15 Monitor and Control Technical Effort
37Which SSE-CMM capability model has no comparable level within the CMMI?
- APredictable
- BManaged
- CIncomplete
- DPerformed
38Which of the following standards defined a set of criteria for technically based evaluation of ICT products?
- AISO 15408
- BIEEE 830
- CISO 15448
- DISO 9001
39What step in the eight steps required to start an SQA program identifies required standards and practices?
- AInitiation
- BIdentification
- CWriting the plan
- DEstablishment
40_ is the process of validating the claimed identity of an end computer or network user or a device such as a host computer, router, or some other physical element.
- Aauthentication
- Bauthorization
- Cprivilege
- Dauthentication & authorization
41What must an organization establish in order to perform a SAMM based assessment?
- ABaseline
- BQuality control
- CConfiguration control
- DBenchmarks (or metrics)
42What two types of assessment methods are employed with the CMM model?
- ASoftware control evaluation (SCE) and software maturity assessment (SMA)
- BSoftware configuration evaluation (SCE) and software model assessment (SMA)
- CSoftware capability evaluation (SCE) and software process assessment (SPA)
- DSoftware capability evaluation (SCE) and software model assessment (SMA)
43___ is the generic term used in the description of biometric systems (e.g., face or iris) relating to their fundamental function.
- Arecognition
- Bidentification
- Ctemplate
- Dverification
44What KPA at the defined level establishes and assigns responsibilities for refining an organization's software processes?
- AOrganization process definition
- BIntegrated software management
- CTraining program
- DOrganization process focus
45What practice under the BSIMM involves the detection and correction of security flaws, providing sanity checks and internal/external tests?
- ADeployment - Software environment
- BSSDL Touchpoints - Security testing
- CDeployment - Security checks
- DDeployment - Penetration testing
46Which SAMM practice focuses on the inspection of software in the runtime environment to find security problems?
- ADesign review
- BSoftware review
- CSecurity testing
- DCode review
47What are the two aspects of the quality assurance process?
- AProduct testing and process verification
- BProduct testing and process assurance
- CProduct assurance and process assurance
- DProduct assurance and process verification
48According to the BSIMM, what practice area is typically the least mature amongst the organizations analyzed?
- ACompliance and policy
- BTraining
- CCode review
- DAttack models
49Which of the following options for use with interval scorecards within SAMM captures scores from detailed assessments versus expected performance levels?
- AGap analysis
- BSecurity evaluation
- CDemonstrating improvement
- DOngoing measurement
50What BSIMM practice focuses on activities associated with change management, which affect an organization's security?
- ASecurity testing
- BConfiguration management and vulnerability management
- CSoftware environment
- DPenetration testing
51What area within the SSE-CMM contains 11 high-level control (practice) areas with a number of underlying controls?
- ASecurity Control Base Practice
- BProject Control Base Practice
- CProject and Organizational Base Practice
- DSecurity Base Practice
52At what SSE-CMM capability level is the performance of base practices planned and tracked?
- AManaged
- BEstablished
- CPerformed
- DPredictable
53How many control areas exist within the SSE-CMM?
- A22
- B12
- C16
- D10
54The second edition of the SSE-CMM was approved by the ISO in what year?
- A1993
- B1998
- C2008
- D2002
55What KPA at the defined level establishes and assigns responsibilities for refining an organization's software processes?
- ATraining program
- BOrganization process focus
- CIntegrated software management
- DOrganization process definition
56According to the BSIMM analysis, what was noted as being critical to the success of programs within all 51 organizations?
- AEstablishment of a configuration control board (CCB)
- BCreation of a regular audit schedule
- CUse of a project planning application
- DEstablishment of a software security group (SSG)
57What job function involves people who perform high-level design work and large-scale system engineering?
- AArchitects
- BDevelopers
- CQA testers
- DSupport operations
58Which SSE-CMM capability model has no comparable level within the CMMI?
- APerformed
- BPredictable
- CIncomplete
- DManaged
59The verification of physical and functional completeness of software items against requirements task occurs under what section of configuration management?
- ARelease management and delivery
- BProcess implementation
- CConfiguration identification
- DConfiguration evaluation
60After defects are found in a software product and reported, what should the next step be?
- ANote defect in the production logs and provide management with an overview of the defect
- BPublish information regarding the defect
- CDevelop fix for defect
- DSubmission of defects to a defect management system
61What are the 3 views of Security?
- ADefense, Offense, and Detection
- BControl, Deterrence, and Integrity
- CDefense, Deterrence, and Detection
- DDefense, Auditing, and Authorization
- EConfidentiality, Integrity, Availability
62The process of mutual authentication involves _______________
- AA user authenticating to a system and the system authenticating to the user
- BA user authenticating to two systems at the same time
- CA user authenticating to a server and then to a process
- DA user authenticating, receiving a ticket, and then authenticating to a service
63Spoofing can be described as which of the following?
- AEavesdropping on a communication link
- BWorking through a list of words
- CSession hijacking
- DPretending to be someone or something else
64If a company has a high turnover rate, which access control structure is best
- ARole based
- BDecentralized
- CRule based
- DDiscretionary
65Which best describes authentication
- ARegistering a user
- BIdentifying a user
- CValidating a user
- DAuthorizing a user
66Which is the most important item when it comes to ensuring that security is successful in an organization
- ASenior management support
- BBiometric based smartcards for building access
- CInternal web access to policies and procedures
- DCentralized management of anti-virus on all desktop machines
67Which of the following best describes a value-"role based access control" offers companies in reducing administrative burdens
- AIt allows users to change access rights whenever they want.
- BIt ensures secure communication between computers.
- CUser membership in roles can be easily revoked and new ones established as job assignments dictate
- Denforces an enterprise-wide security policy, standards, and guidelines
68An access control model should be applied in a _______________ manner
- ADetective
- BRecovery
- CCorrective
- DPreventive
69A password is mainly used for what function?
- AIdentity
- BRegistration
- CAuthentication
- DAuthorization
70What is the primary purpose of using one-way hashing on user passwords?
- AMinimizes the amount of primary and secondary storage needed to store passwords
- BPrevents anyone from reading passwords in plaintext
- CAvoids excessive processing required by an asymmetric algorithm
- DPrevents replay attacks
71Which three security protocols operate at layer 4 and which transport layer protocols they can be used with?
- ATLS/SSL with UDP, DTLS with TCP, SSH with UDP
- BIPsec with TCP, PGP with UDP, SET with TCP
- CTLS/SSL with TCP, DTLS with UDP, SSH with TCP
- DSET with TCP, PGP with UDP, SSL with TCP
72When should security first be addressed in a project?
- ADuring requirements development
- BDuring integration testing
- CDuring design specifications
- DDuring implementation
73The first phase of risk management is ____.
- Arisk identification
- Brisk control
- Cdesign
- Drisk evaluation
74Bit stream methods commonly use algorithm functions like the exclusive OR operation (____)
- AXOR
- BNOR
- CEOR
- DOR
75____ functions are mathematical algorithms that generate a message summary or digest to confirm the identity of a specific message and to confirm that there have not been any changes to the content
- AHash
- BKey
- CMap
- DEncryption
76____ is an integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely
- AMAC
- BDES
- CPKI
- DAES
77A guideline is typically a collection of system specific or procedural specific "suggestions" for best practice. These are not requirements that must be met, but are strongly recommended.
- AT
- BF
78A Biometrics task force will directly correlate to the combination of effective technology and effective policy. It will deliver capabilities in order to contribute to the enhancement of the biometric community.
- AT
- BF
79Biometrics is the study of:
- Abiological data
- Bbiometric-based authentication
- Cspecific personal traits for access control
- Dall
80A ________________ is a relatively stable human physical characteristic.
- Abehavioral characteristic
- Bphysiological characteristic
- Ckeystroke characteristic
- Dtyping characteristic
81A _________ is a user setting for biometric systems operating in the verification or open-set identification (watch list) tasks.
- Arange
- Bthreshold
- Cidentity
- Dfunction
82______________ is the process of searching for unknown information or relationships in large databases.
- Adata searching
- Bdata mining
- Cscanning
- Dquery
83A new biometric security standard, ___________, provides a technology-specific extension to the ISO/IEC 17799/27001 Code of practice for information security management.
- AIEEE 19092
- BISO 19290
- CISO 19092
- DIEC 27001
84A biometric policy is a set of ___________ that indicate the applicability of a biometric reference template for use by some community or class of applications that have common security requirements
- Arules
- Bstandards
- Cpolicies
- Dguidelines
85A ________________ is a password-protected file that contains identification information about its holder.
- Adigital certificate
- Bdigital signature
- Ccertificate
- Dcertificate authority
Informações
- Descrição
- Computer Science Quiz sobre SE, criado por Shalury W.W. em 13-05-2018.
- Autor
- Shalury W.W.
- Idioma
- English
- Visualizações
- 0
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz