Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia SEC+ > Section 2.3 Secure Application development, deployment, and automation concepts > Flashcards

Section 2.3 Secure Application development, deployment, and automation concepts Flashcards

1
Q

What do you call the ability to add, remove, or reconfigure hardware and software resources to handle an increase in usage. Requires manual intervention

A

Scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What do you call automatically scaling resources up or down to meet user demands. Completely automatic

A

Elasticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What SDLC method goes through each step one by one until they are completed?

A

Waterfall method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Developers use ____________ to make sure an application does not contain security issues and is resistant to application errors and crashes.

A

Secure Coding Concepts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What do you call a nonprofit foundation that works to improve the security of software?

A

OWASP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does OWASP stand for?

A

Open Web Application Security Project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who produces a top 10 vulnerabilities list that has the most common vulnerabilities, how they are exploited, and how to prevent them?

A

OWASP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What brings together management, development, and operations groups to swiftly release software into production

A

DevOps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What do you call infrastructure that can not be changed once it is placed?

A

Immutable Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What tools check the various courses of action within the code, validate inputs, and plays a role in integration, delivery, deployment, and monitoring while providing reporting and analytics?

A

Automation/Scripting Tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do you call the surrounding infrastructure that supports software applications?

A

Data Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What manages and provisions data centers through machine readable files to support software and user requirements?

A

Infrastructure as Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What control keeps multiple developers from overwriting changes that were written by other developers?

A

Version Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What ensures everyone associated with a software change understands what changes will be made, when they will be made, and any 2nd or 3rd order effects?

A

Change Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What refers to the process of coding applications to accept only certain valid input for user-entered fields?

A

Input Validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What concept recognizes specific types of command characters and parses them as simple data rather than executing the text as a command?

A

Escaping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the practice of using either predetermined processes or synthetic processes to create diversity within the software development process?

A

Software diversity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What analysis is conducted by executing software on a real or virtual processer, with inputs to allow the tester to determine how the software will behave in a potentially negative environment?

A

Dynamic code analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What dynamic technique enters random data into application fields to see how the software program reacts to test for input validation and exception handling?

A

Fuzzing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What analysis is performed without executing the code, but uses either an automated tool or manual reviewing?

A

Static code analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What checks the ability for a piece of software to undergo large amounts of stress or extremely heavy operating loads by pushing the software beyond its normal or best-scenario operating environments?

A

Stress testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What testing provides key performance indicators of software integrity to help measure how effectively software is developed and how efficiently it is tested prior to deployment?

A

Integrity Measurement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is largely determined by the OS and programming language environment in use because they can offer varying levels of tools?

A

Error and Exception Handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What uses up memory resources needed to execute actions associated with applications?

A

Resource Exhaustion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What occurs when you have access permissions or systems of trust between different components of a software application that allow users to pass through unexpectedly and without proper authorization to access another software component?

A

Transitive Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which type of validation responds to users quicker but the client must have compatible software with the server?

A

Client-side validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which type of validation is more compatible but responds slower and is safer because the application code isn’t shared?

A

Server Side validation

28
Q

What is prevented by verifying a request came from an authorized user by requiring a second identifying value saved saved in a cookie to authenticate an authorized session?

A

CSRF

29
Q

What is CSRF

A

Client Side Request Forgery

30
Q

What do you call the use of existing source code for a new purpose?

A

Code Reuse

31
Q

What is a SDK?

A

Software Development Kit

32
Q

What entails using a certificate to digitally sign executables and scripts to confirm that the software was developed by the appropriate author?

A

Code Signing

33
Q

What hard codes and shares data?

A

Data exposure

34
Q

What do you call code that is never used or executed and its removal can cause exceptions or a change in output?

A

Dead Code

35
Q

What is the design of a database to remove redundancies and improve integrity through simplifying the design?

A

Normalization

36
Q

What are saved subroutines that can be used within applications accessing databases?

A

Stored Procedures

37
Q

In what environment is software developed? Often done in a sandbox.

A

Development (DEV)

38
Q

In what environment is software tested, either in a static or dynamic manner?

A

Testing (TEST)

39
Q

What environment is built for iterative testing to assure new code does not have negative impacts on the funtionality?

A

Quality Control/Assurance (QC/QA)

40
Q

What environment allows the code to be subjected to final testing before being moved to production?

A

Staging(STAGING)

41
Q

What is the final, live environment that users get to interact and work with?

A

Production (PROD)

42
Q

In what environment is the application initially coded, often through multiple iterations?

A

Development

43
Q

In what environment do the developers integrate all of their work into a single application?

A

Testing

44
Q

In what environment do we ensure quality assurance before we roll it out to production?

A

Staging

45
Q

In what environment does the application go live and end users have the support of the IT team?

A

Production

46
Q

What do you call the process of making an application or service available? May also refer to the lifecycle of designing, preparing, creating, and managing the applications?

A

Provisioning

47
Q

What process occurs when the application meets its end of life?

A

Deprovisioning

48
Q

What is the measuring and identification of changes to a system, away from its expected or baseline value?

A

Integrity Measurement

49
Q

What process ensures that the application performs as it should do and conforms to data industry standards and regulations?

A

Integrity Measurement

50
Q

Code updates should be _______________ to ensure functionality is intact and no security vulnerabilities exist.

A

regression tested

51
Q

What is the result of integrity measurement?

A

A secure baseline configuration

52
Q

The goal of ________ is to reduce and eliminate redundancy to make fewer indexes per table and make searching faster.

A

Normalization

53
Q

A ___________ is reusable, prepared SQL code.

A

Stored procedure

54
Q

When apps use ______________, it will provide the required information while ensuring an attack will not be able to modify the code it contains.

A

Stored procedures

55
Q

What is the process of obscuring source code so that if it was stolen, it could not be interpreted or reverse engineered by the attacker?

A

Obfuscation/Camouflage

56
Q

What are server-side programming languages?

A

C# and .NET

57
Q

__________ execution and validation includes databases, application servers, and domain controllers

A

Server-side/backend

58
Q

What kind of execution and validation happen on the client in the browser?

A

Client-Side

59
Q

What are the client-side languages?

A

JavaScript and HTML 5

60
Q

Failure to manage memory in code may result in?

A

Memory Leaks

61
Q

What is a set of software development tools that a vendor creates to make application development easier?

A

SDK

62
Q

Sensitive data should be ________to prevent it from being stolen by attackers, and sometimes masked even to the user.

A

encrypted

63
Q

What do you call creation of software that is different on each user endpoint/device?

A

Software diversity

64
Q

What do you call the process of testing to make sure that an application is fit for its purpose and fulfills the user’s requirements, and ensures security requirements are met?

A

Continuous validation

65
Q

What do you call the ability of a system to automatically grow and shrink based on app demand?

A

Elasticity

66
Q

What do you call the ability of a system to handle growth of users or work?

A

Scalability

Comptia SEC+ (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions