Software Dev Flashcards
Which software development life cycle model allows for multiple iterations of the development process, resulting in multiple prototypes, each produced according to a complete design and testing process?
A. Software Capability Maturity model
B. Waterfall model
C. Development cycle
D. Spiral model
The spiral model allows developers to repeat iterations of another life cycle model (such as the waterfall model) to produce a number of fully tested prototypes.
SW-CMM
IRDMO
Software Capability Maturity Model
- Initial
- Repeatable
- Defined
- managed
- Optimizing
IRDMO
IDEAL
based on CW-CMM
- Initiating
- Diagnosing
- Establishing
- Acting
- Learning
What is system accreditation?
A. Formal acceptance of a stated system configuration
B. A functional evaluation of the manufacturer’s goals for each hardware and software component to meet integration standards
C. Acceptance of test results that prove the computer system enforces the security policy
D. The process to specify secure communication between machines
Accreditation is the formal acceptance process. Option B is not an appropriate answer because it addresses manufacturer standards. Options C and D are incorrect because there is no way to prove that a configuration enforces a security policy and accreditation does not entail secure communication specification.
Which one of the following is not part of the change management process?
A. Request control
B. Release control
C. Configuration audit
D. Change control
Configuration audit is part of the configuration management process rather than the change control process.
What is system certification?
A. Formal acceptance of a stated system configuration
B. A technical evaluation of each part of a computer system to assess its compliance with security standards
C. A functional evaluation of the manufacturer’s goals for each hardware and software component to meet integration standards
D. A manufacturer’s certificate stating that all components were installed and configured correctly
A system certification is a technical evaluation. Option A describes system accreditation. Options C and D refer to manufacturer standards, not implementation standards.
Which one of the following is not a component of the DevOps model?
A. Information security
B. Software development
C. Quality assurance
D. IT operations
The three elements of the DevOps model are software development, quality assurance, and IT operations.
Richard believes that a database user is misusing his privileges to gain information about the company’s overall business trends by issuing queries that combine data from a large number of records. What process is the database user taking advantage of?
A. Inference
B. Contamination
C. Polyinstantiation
D. Aggregation
In this case, the process the database user is taking advantage of is aggregation. Aggregation attacks involve the use of specialized database functions to combine information from a large number of database records to reveal information that may be more sensitive than the information in individual records would reveal.
Which Bell-LaPadula property keeps lower-level subjects from accessing objects with a higher security level?
A. (star) Security Property
B. No write up property
C. No read up property
D. No read down property
The no read up property, also called the Simple Security Policy, prohibits subjects from reading a higher security level object.
Which security model addresses data confidentiality?
A. Bell-LaPadula
B. Biba
C. Clark-Wilson
D. Brewer and Nash
Only the Bell-LaPadula model addresses data confidentiality.
The Biba and Clark-Wilson models address data integrity.
The Brewer and Nash model prevents conflicts of interest.
In a relational database, what type of key is used to uniquely identify a record in a table and can have multiple instances per table?
A. Candidate key
B. Primary key
C. Unique key
D. Foreign key
A
A candidate key is a subset of attributes that can be used to uniquely identify any record in a table. No two records in the same table will ever contain the same values for all attributes composing a candidate key. Each table may have one or more candidate keys, which are chosen from column headings.
During what phase of incident response do you collect evidence such as firewall logs?
A. Detection
B. Response
C. Compliance
D. Remediation
B
Evidence collection takes place during the response phase of the incident. Incidents are identified and verified during the detection phase. Compliance with laws might occur during the reporting phase, depending on the incident. Personnel typically perform a root-cause analysis during the remediation phase.
When establishing who someone is before you grant them access to resources, what is the first step?
A. Verify credentials
B. Claim an identity
C. Grant authority
D. Monitor activity
B
The first step toward granting a user access is for them to claim an identity (identification). That is followed by verifying credentials (authentication), then by granting authority (authorization), and finally by monitoring activity (auditing).
What rule of evidence states that a written agreement is assumed to contain all terms of the agreement?
A. Real evidence
B. Best evidence
C. Parol evidence
D. Chain of evidence
c
The parol evidence rule states that when an agreement between parties is put into written form, the written document is assumed to contain all the terms of the agreement, and no verbal agreements may modify the written agreement.
