Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 25: Secure Software > Flashcards

Chapter 25: Secure Software Flashcards

1
Q

machine language

A

consists of 1’s and 0’s; only format a computer’s processor can understand directly; considered a first-generation language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Assembly language

A

second-generation programming language, uses symbols (mnemonics) to represent complicated binary codes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

third-generation programming languages

A

high-level languages (C/C++, Java, Python) have refined programming structures; programming language deals with the low-level system architecture and programmers focus on their programming objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

fourth-generation languages

A

very high-level languages; use natural language processing to allow inexpert programmers to develop code in less time than it would take an experienced software engineer to do so with a third-generation language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

fifth-generation languages

A

natural languages; define the constraints for achieving a specified result and allow development environment to solve problems by itself instead of a programmer having to develop code to deal with individual and specific problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

assemblers

A

tools which convert assembly language source code into machine code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

compilers

A

transform instructions from a source language (high-level) to a target language (machine), sometimes using an external assembler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

garbage collector

A

identifies blocks of memory which were once allocated but are no longer in use and deallocates the blocks and marks them as free

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RTE

A

runtime environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

runtime environment

A

a mini operating system for the program and provides all the resources portable code needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

OOP

A

object-oriented programming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

object-oriented programming

A

functions and data are encapsulated together in classes, which may then be instantiated as objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

objects in OOP communicate by …

A

using messages which conform to the receiving object’s application programming interface (API) definition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

cohesion

A

how many different types of tasks a module can carry out; goal is to perform only one task (high cohesion), which makes modules easier to maintain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

coupling

A

measure of how much a module depends on others; more dependencies are more complex and difficult to maintain, so low or loose coupling is ideal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

API

A

the manner in which a software component interacts with other software components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

parameter validation

A

confirming the parameter values being received by an application are within defined limits before they are processed by the system

18
Q

software library

A

collection of components which do specific tasks useful to other components

19
Q

secure coding

A

set of practices which reduce (to acceptable levels) the risk of vulnerabilities in software

20
Q

source code vulnerability

A

defect in code which provides threat actors opportunities to compromise the security of a software system

21
Q

secure coding standards

A

verifiable, mandatory practices to reduce the risk of particular types of vulnerabilities in source code

22
Q

secure coding guidelines

A

recommended practices which tend to be less specific than standards

23
Q

SDS or SDSec

A

software-defined security

24
Q

software-defined security

A

security model in which security functions: firewalling, IDS/IPS, and network segmentation are implemented in software within an SDN environment

25
Q

software development tools

A

authorized, implemented, and maintained like any software product through the org’s change management process; developers should not be allowed to install and use arbitrary tools

26
Q

static application security testing

A

SAST; helps identify software defects or security policy violations and carried out by examining source code without executing the program

27
Q

DAST

A

dynamic application security testing; evaluation of the program in real time, while it is running

28
Q

Fuzzing

A

used to discover flaws and vulnerabilities in software by sending large amounts of malformed, unexpected, or random data to the target program to trigger failures

29
Q

continuous integration

A

all new code is integrated into the rest of the system as soon as the developer writes it

30
Q

continuous delivery

A

incrementally building a software product which can be released at any time and requires continuous integration

31
Q

SCM

A

software configuration management; identifies attributes of software at various points in time and performs a methodical control of changes for the purpose of maintaining software integrity and traceability throughout the SDLC

32
Q

purpose of software security assessment

A

to verify the entire development process, organizational policy to delivered product is working as it should

33
Q

security assessments of acquired software are …

A

essential to mitigate the risk they could pose to an org which acquired it

34
Q

most practical way to assess the security of commercial software

A

to research vulnerabilities and exploits discovered by others to decide if the vendor uses effective secure coding practices

35
Q

greatest risk in using open-source software

A

relying on outdated versions of it

36
Q

best way to assess the security of third-party (custom or customized) software

A

perform external or third-party audits

37
Q

assembly language into machine language

A

assembler

38
Q

software escrow framework

A

third party keeps a copy of the source code, which will be released to the customer in specific circumstances (developer going out of business); a good business continuity practice, but not part of security

39
Q

perform only one task so modules are easier to maintain

A

high cohesion

40
Q

low cohesion

A

module performs many different types of tasks

41
Q

software-defined security depends on …

A

software-defined networking (SDN)

42
Q

top three reasons for data breaches in cloud services

A

misconfigurations, lack of visibility into access settings and activities, and improper access control

CISSP (29 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions