pReview Flashcards
An organization develops its own software using a software development life cycle (SDLC) model. The model avoids life cycle activities where the production of software will not be directly involved and emphasizes an evolutionary approach to software production that focuses on “build a little, test a little, field a little.”
Which model could the organization use for secure software development based on these requirements?
Unified process
Agile model
Waterfall model
Iterative model
Agile model
A software firm is planning to develop a web-based project with a team of up to eight people.
What is a relevant software methodology to apply where others’ roles may be filled by the same people, including a project manager and business expert?
Crystal orange web Waterfall Crystal orange Crystal clear Scrum
Crystal clear
A company is selecting an SDLC model that will work best for a project. The project has the following characteristics:
* All requirements will be specified in the first step. * It uses a document-driven approach. * It has specific and identifiable stages.
Which SDLC model should the company select?
Waterfall
Rational unified process (RUP)
Spiral
Agile
Waterfall
Classify each item as an attribute of either the waterfall or agile software development models.
Answer options may be used more than once or not at all. Select your answer from the pull-down list.
Choose from the following: Agile or Waterfall
- Cyclical process
- Similar to iterative model
- Supports quick prototyping
- Main components are planning, development, and deployment
- Limits the time spent thinking about the problem as a whole
- Cyclical process - Agile
- Similar to iterative model - Waterfall
- Supports quick prototyping - Agile
- Main components are planning, development, and deployment - Waterfall
- Limits the time spent thinking about the problem as a whole - Agile
Which system development methodology provides a resource to entry-level developers with limited exposure?
Joint application development
Agile model
Waterfall model
Extreme programming
Waterfall model
A new business system is being developed that automates the process of approving remote banking transactions. A requirement of this system is that each transaction has proof of approval by an authorized user.
Which capability should be implemented to provide this assurance?
Hashed passwords
Encrypted wide area network
Encrypted tunnel
Digital signatures
Digital signatures
A database administrator validates a database after deploying a software system over the Internet. The administrator notices corrupted data throughout the database while dealing with the sensitive personal information.
Which key security principle has been lost?
Integrity
Confidentiality
Availability
Authentication
Integrity
A company is developing an application that will allow customers to upload photos to their servers to share and store. The application has the following requirements:
* The company can instill confidence in their customers that their digital photos will always be available. * Customers can be guaranteed that their data will not be lost. * The application will have failover with a hot site.
What should the company implement?
Hashing
Redundancy
Stenography
Encryption
Redundancy
A business system has an operational requirement to validate the data integrity of any personnel files transmitted between office locations.
Which measure will validate the integrity of the files?
Symmetric encryption Key distribution Hashing Asymmetric encryption Authentication
Hashing
Classify each secure software design feature by the core element of cybersecurity that feature belongs to.
Answer options may be used more than once or not at all. Select Confidentiality, Integrity, or Availability:
Off-site backup Public key Hash Message digest
Off-site backup - Availability
Public key - Confidentiality
Hash - Integrity
Message digest - Integrity
Classify each secure software design feature by the core element of cybersecurity that it belongs to.
Answer options may be used more than once or not at all. Select Confidentiality, Integrity, or Availability:
Cryptography Non-repudiation Redundancy Digital signatures
Cryptography - Confidentiality
Non-repudiation - Integrity
Redundancy - Availability
Digital signatures - Integrity
A company is developing a web application for employees. The web application must meet the following requirements:
- Employees must be able to use the web application to track shipments.
- The web application must be able to store personal information and shipment details.
- Although the web application will be accessible outside of the company’s intranet, employees’ information must be secure.
Which process should be used to make certain that the web application meets these requirements?
Redundancy in the data
SDLC agile model
SDLC waterfall model
Software assurance
Software assurance
A development team is given a project that has security concerns and that contains very valuable data to would-be adversaries. The project is considered a high-risk environment, and the team must take greater steps than normal to protect the confidentiality and integrity of the system.
Which three steps should the development team take to ensure that the high-risk environment is secure?
Choose 3 answers
Proper handling of errors and exceptions Stress testing Building in fault tolerance Isolating trusted processes Sandboxing Load testing
Proper handling of errors and exceptions
Isolating trusted processes
Sandboxing
A web application that will allow customers to pay utility bills online is being developed using the waterfall model of the SDLC. The security team wishes to establish a baseline expectation of functionality.
Which event meets this requirement?
Attack surface reduction
Final security review
Vulnerability mapping
Beta version release
Beta version release
A senior developer at a software company needs to enhance the security of the system. During the construction phase, the developer implements a messaging solution that addresses both confidentiality and integrity.
Which solution did the developer implement?
Hash the message twice.
Make a copy of the message for future comparison.
Encrypt the message and a hash symmetrically.
Use an initialization vector with random salt.
Encrypt the message and a hash symmetrically.
A development team has chosen the waterfall methodology as an SDLC approach. This methodology was chosen because of the limited experience of the team, but waterfall has several security considerations.
Match each phase of the waterfall methodology to its appropriate security concern.
Answer options may be used more than once or not at all. Select from the following list: Define security features Secure coding practices Final security review Penetration assessment Periodic security review and updates Misuse cases/vulnerability mapping
Requirements analysis Design Construction/implementation Testing Installation Operation
Requirements analysis - Define security features
Design - Misuse cases/vulnerability mapping
Construction/implementation - Secure coding practices
Testing - Penetration assessment
Installation - Final security review
Operation - Periodic security review and updates
Given the diagram for enterprise single sign-on (SSO) for a business system, which two potential attack surfaces or vulnerabilities apply?
Choose 2 answers
- Malicious users can tamper with data as it travels from one source to another.
- The design allows the potential for cross-site scripting.
- Insider threats can potentially access more internal systems.
- Many single point-of-failure servers with impact on denial-of-service attacks.
- Insider threats can potentially access more internal systems.
- Many single point-of-failure servers with impact on denial-of-service attacks.
A system log-in process is described with the following use cases:
UC1: User Requests Log-in Page UC2: System Requests Credential UC3: System Provides Site Credentials UC4: System Delivers Page
A developer has performed threat modeling using STRIDE.
Which fail case exit states will address threats from the “D” category of STRIDE?
Encrypt user credentials.
Clear user credentials from cache.
Use alternate authentication service.
Implement public key infrastructure (PKI).
Use alternate authentication service.
A system log-in process is described with the following use cases:
UC1: User Requests Log-in Page UC2: System Requests Credential UC3: System Provides Site Credentials UC4: System Delivers Page
A developer has performed threat modeling using STRIDE.
Which use case should be added to address threats from the “T” category of STRIDE?
UC5: User Verifies Hash of Delivered Data
UC5: User Enters Second Factor Authentication Credentials
UC5: System Encrypts Cached User Credentials
UC5: System Delivers Public Key Infrastructure (PKI) Certificate
UC5: System Clears Cached User Credentials
UC5: User Verifies Hash of Delivered Data
Given the architecture of the software system diagram, the application server is using insecure exception handling.
Which potential security issue does this create?
Dictionary attacks
Over-privileged accounts
Denial-of-service (DoS) attacks
Disclosure of system-level details
Disclosure of system-level details
The local county office has decided to add online transaction capabilities for all of the services it provides to residents, including permits, driver’s licenses, and interactive satellite mapping of the entire county. An encryption module has been implemented to protect user data. System stakeholders have decided to remove the encryption module due to the increased processing overhead required by the security module.
What is the potential risk of this vulnerability to personally identifiable information (PII)?
Permanent deletion of this stored data
Possible disclosure of this stored data
Lack of availability of this stored data
Lack of authentication of this stored data
Possible disclosure of this stored data
The set of use cases in the given graphic depict the log-in process for a system. The software architect who is building a mobile app has a concern about the presentation of expired, unauthorized, or unverified public key infrastructure (PKI) certificates and associated attacks that involve those certificates. The architect has identified a fail case exist state as shown in the lower right of Diagram 4, but is uncertain of the use case to which it applies.
Which use case should be associated with the PKI certificate error fail state?
User requests log-in page
Server authenticates user credentials
Establish encrypted connection between client and server
System delivers log-in page
System delivers log-in page
Which modeling approach assigns ratings based on attack reproducibility and vulnerability exploitability?
CVSS
OCTAVE
STRIDE
DREAD
DREAD
Which narrative approach should help guide the mitigation that needs to be put in place to protect a system from attacks?
Attack tree
Penetration testing
Model-driven development
Threat model
Threat model
