Domain 4 Flashcards
Which of the following is NOT a recommended consideration pertaining to application controls?
a) Potential risk
b) End-user opinion
c) Available controls
d) Environment type
End-user opinion
Which type of environment has everything organized, controlled and performed from one location?
a) Decentralized
b) Distributed
c) Centralized
d) Compartmentalized
Centralized
Which type of environment has multiple independent locations with little or no communications between the entities?
a) Centralized
b) Decentralized
c) Distributed
d) Compartmentalized
Decentralized
In the context of Object Oriented Systems, which of the following best describes an object?
a) A function or set of functions accessible only through its Application Program Interfaces (API)
b) A ‘black box’ that receives and sends messages
c) A code module that publishes both its code and data
d) A code subroutine that contains both code and data
A ‘black box’ that receives and sends messages
Which type of environment has communication and coordination between multiple locations?
a) Distributed
b) Centralized
c) Decentralized
d) Compartmentalized
Distributed
Which of the following is NOT a mode of operation?
a) System High Mode
b) Compartment Mode
c) System Low Mode
d) Multi-level Secure Mode
System Low Mode
Which of the following modes is relatively simple and can be implemented with most operating systems?
a) System High Mode
b) Compartment Mode
c) Security Mode
d) Decompartment Mode
System High Mode
What is the method ActiveX relies on for security?
a) NTLM
b) Symmetrical encryption
c) Digital signatures
d) Sand-boxing
Digital signatures
What is the main reason to consider security in the change control process?
a) To ensure that changes are securely recoded, tested and documented
b) To ensure that id, control and configuration audit is performed in a secure manner
c) To ensure that release, archiving and acceptance testing is performed securely
d) To ensure that security mechanisms are not negatively impacted by the proposed changes
To ensure that security mechanisms are not negatively impacted by the proposed changes
At which critical step in the development process does the project manager expect to see the security risks defined?
a) Design analysis
b) System design specifications
c) Project initiation
d) Installation
Project initiation
One of the most commonly exploited security vulnerabilities - buffer overflows - are addressed in which phase of the development process?
a) System design specification
b) Design analysis
c) Operation and maintenance
d) Programming and testing
Programming and testing
What is the main concern with simply deleting files during the destruction phase of the development process?
a) There is no concern.
b) Deleted data can still be extracted from hard drives.
c) Deleted data still uses up a small portion of the capacity of the hard drive.
d) Ease dropping
Deleted data can still be extracted from hard drives
Requiring a biometric fingerprint to enter a server room, followed by a username and password at the system console, followed by a pin to access the application, best represents which operational control?
a) Least privilege
b) Continuity of operations
c) Layered defense
d) Separation of duties
Layered defense
Which software development model has unique, discrete, sequential phases?
a) Spiral model
b) Top-down model
c) Waterfall model
d) Bottom-up model
Waterfall model
Which mode of operation is difficult to implement and cannot be done with most operating systems?
a) Client/Server Mode
b) Compartment Mode
c) System High Mode
d) System Low Mode
Compartment Mode
