Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Study > Software Development Security > Flashcards

Software Development Security Flashcards

1
Q

Which phase of security development should security considerations take place?

A

All

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is not an example of computer-aided software engineering (CASE)?

A. program editors
B. version-control mechanisms
C. static code analysis software
D. manual code review
E. debugger
A

D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following are secure software development best practices? (Choose all that apply)

A. OWSAP
B OWASP
C. BSI
D. ISO/IEC 27034
E. ISO/IEC 27055
A

B, C, D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the top three in the top 10 OWASP web application security risks.

A. Insecure Direct Object Reference
B. Cross-Site Request Forgery (CSRF)
C Cross-Site Scripting (XSS)
D. Injection
E. Sensitive Data exposure
F. Security Misconfiguration
G. Broken Authentication and Session Management
H. Using Components with Known Vulnerabilities
A

C, D, G

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This is the act of sending random data to the target program in order to trigger failures.

A

Fuzzing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

List the five maturity levels in CMMI.

A 
1 = Initial
2 = Repeatable
3 = Defined
4 = Managed
5 = Optimizing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This SDLC model emphasizes verification and validation at each phase.

A

V-Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In this SDLC model, multiple development cycles are carried out on a piece of software throughout its development stages.

A

Incremental

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This SDLC model takes an iterative approach that emphasizes risk analysis per iteration.

A

Spiral

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This SDLC model creates a sample of the code for proof-of-concept purposes. Not really used to produce production code.

A

Prototyping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This SDLC model combines prototyping and iterative development procedures with the goal of accelerating the software development process

A

Rapid Application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

This SDLC model has iterative and incremental development processes that encourage team-based collaboration and flexibility and adaptability instead of a strict process structure.

A

Agile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

This is the term for a multidisciplinary development team with representatives from many or all the stakeholder populations.

A

IPT

Integrated Product Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Various levels of testing should be carried out during development. Which of following is not a testing type?

A. Acceptance
B. Regression
C. Aggregation
D. Integration
E. Unit
A

C

Acceptance testing = Ensuring code meets customer requirements

Regression testing = Testing after changes take place

Integration = verifying components work together in the production environment.

Unit = testing individual components. Mature developers develop unit tests for their modules before they even start coding or in parallel. Known as TEST-DRIVEN development.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This type of software development testing verifies components work together in the production environment.

A

Integration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

This type of software development testing takes place after changes.

A

Regression testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

This type of software development testing is done to ensure code meets customer requirements.

A

Acceptance testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following tasks does not belong in the requirements gathering phase of SDLC? (You can choose more than one)

A. Threat modeling
B. Security risk assessment
C. Privacy risk assessment
D. Risk-level acceptance
E. Static analysis
A

A, E

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following tasks belongs in the development phase of SDLC? (You can choose more than one)

A. Threat modeling
B. Security risk assessment
C. Privacy risk assessment
D. Risk-level acceptance
E. Static analysis
A

E

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which of the following tasks belongs in the design phase of SDLC? (You can choose more than one)

A. Threat modeling
B. Security risk assessment
C. Privacy risk assessment
D. Attack surface analysis
E. Static analysis
A

A, D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following tasks belongs in the Testing/validation phase of SDLC? (You can choose more than one)

A. Threat modeling
B. Dynamic analysis
C. Regression Testing
D. Attack surface analysis
E. Static analysis
A

B, C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

At this level of CMMI, the company has formal processes in place to collect and analyze quantitative data and metrics are defined and fed into the process-improvement program.

A. Optimizing
B. Managed
C. Defined
D. Repeatable

A

B

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

At this level of CMMI, a formal management structure is in place and the company can properly repeat processes throughout each project, but the company does not have formal process models defined.

A. Optimizing
B. Managed
C. Defined
D. Repeatable

A

D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

At this level of CMMI, the company has budgeted and integrated plans for continuous process improvement.

A. Optimizing
B. Managed
C. Defined
D. Repeatable

A

A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Any decent software configuration management system comes with “versioning,” but some systems also allow check out of complete or partial code, make changes, and then commit their changes back to the master repository as needed and update their own personal copies to stay up to date with changes other people made. This is called ______________.

A

Synchronization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

This type of programming provides modularity, reusabilty, and more granular control within the programs themselves compared to classical programming languages.

A

Object-oriented programming

OOP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

This type of XSS attack exploits the lack of proper input or output validation on dynamic websites.

A

nonpersistent XSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

This type of XSS attack involves modifying the original client-side JavaScript.

A

DOM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

This type of XSS attack is when a the attacker loads malicious code on a server that attacks visiting browsers.

A

persistent XSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the purpose of a DBMS?

A

Database Management System

The software that controls the access restrictions, data integrity, redundancy, and different types of manipulation available for a database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

In a relational database the ___________ is how a specific row is located from other parts of the database. It is a column that makes each row unique.

A

primary key

think “Item ID #” for the IOF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Relational database

Tuple = \_\_\_\_\_\_\_\_\_\_\_
Attributes = \_\_\_\_\_\_\_\_\_\_\_
A

Rows

Columns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

This type of database uses a tree-like structure to define relationships between data elements, using a parent/child relationship.

A

hierarchical database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which type of database programming language defines the structure and schema?

A

DDL
Data definition language

Structure = table size, key placement, views, and data element relationships

schema = type of data that will be held and manipulated, and their properties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which type of database programming language defines queries that enable users to access the data within the database?

A

QL

ad hoc query language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which type of database programming language contains all the commands that enable a user to view, manipulate, and use the database (view, add, modify, sort, and delete commands)?

A

DML

Data manipulation language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which type of database programming language defines the internal organization of the database?

A

DCL

data control language

38
Q

This is a central repository that describes data elements within a database and their relationships.

A

Data Dictionary

39
Q

An attribute of one table that is related to the primary key of another table.

A

Foreign key

40
Q

Defines the structure of the database.

A

schema

41
Q

Hierarchial databases are useful for mapping ___________ relationships.

A. one-to-one
B. one-to-many
c. many-to-one
d. many-to-many

A

B

42
Q

The _________ model is almost always employed when building indexes for relational databases.

A

hierarchical

43
Q

Database integrity is provided by concurrency mechanisms. One concurrency control is ______, which prevents users from accessing and modifying data being used by someone else.

A

locking

44
Q

_________ integrity makes sure that a tuple is uniquely identified by a primary key.

A. Semantic
B. Hierarchical
C. Entity
D. Referential

A

Entity integrity

45
Q

_________ integrity ensures that every foreign key refers to an existing primary key.

A. Semantic
B. Hierarchical
C. Entity
D. Referential

A

Referential integrity

46
Q

Category of programming language that is written in binary.

A

Machine language

47
Q

A category of programming language that is not portable, is low-level, and is a symbolic representation of machine-level instructions

A

Assembly language

48
Q

Converts assembly code to machine code.

A

Assemblers

49
Q

Converts high-level language statements into the necessary machine-level format for specific processors to understand.

A

Compilers

50
Q

In the right kind of environment, this can perform the last step of transforming high-level code to machine-level code. Improves portability and handles memory management, but requires that the ___________ be installed on the local machine.

A

interpreter

51
Q

If there is a problem with a transaction, a database __________ cancels changes and returns the database to its previous state.

A

rollback

52
Q

For databases….

A ___________ operation completes a transaction and executes all changes just made by the user.

A

commit

53
Q

When the database software fills up a certain amount of memory, a _____________ is initiated, which saves the data from the memory segment to a temporary file. If a glitch is experienced, the software will try to use this information to restore the user’s working environment to its previous state.

A. Rollback point
B. Commit point
C. Checkpoint
D. Savepoint

A

checkpoint

54
Q

_______ are used to make sure that if a system failure occurs, or if an error is detected, the database can attempt to return to a point before the system crashed. Can be configured to occur by time interval, a specific user action, or a number of transactions or changes to the database.

A. Rollback point
B. Commit point
C. Checkpoint
D. Savepoint

A

savepoint

55
Q

The act of combining information from separate sources to form new data that the subject does not have the clearance or permission to access.

A

aggregation

56
Q

The ability to derive information not explicitly available

A

inference

57
Q

A technique used to hide specific cells that contain information that could be used in an inference attack.

A

cell suppression

58
Q

A technique of inserting bogus information in the hopes of misdirecting an attacker or confusing a matter enough that the actual attack will not be fruitful.

A

noise and pertubation

59
Q

This involves diving the database into parts, which makes it harder for an unauthorized individual to find connecting pieces to infer something they shouldn’t.

A

partitioning

60
Q

Like operating systems, databases can employ DAC or MAC so that ______ is/are displayed according to group membership, user rights, or security label.

A. data
B. tables
C. views
D. files

A

views

61
Q

This is a process of allowing a table to have multiple rows with the same primary key. The different instances can be distinguished by their security levels or classification. The purpose is to hide higher confidential information from lower level access users who still need access to some of the data to perform a function.

A

polyinstantiation

62
Q

Online transaction processing (OTP) records transactions as they occur (in real time), which usually updates more than one database in a distributed environment. In order to maintain integrity, database software in an OTP environment should implement an ACID test. What does ACID stand for?

A

Atomicity - Divides transactions into units of work and ensures that all modifications take place or none. Either the changes are committed or database is rolled back.
Consistency - A transaction must follow the integrity policy developed for that particular database and ensure all data is consistent in the different databases.
Isolation - Transactions execute in isolation until completed without interacting with other transactions.
Durability - Once the transaction is verified accurate on all systems, it is committed and the database can not be rolled back.

63
Q

This type of program performs useful functionality apparent to the user and malicious functionality without the user knowing it.

A

Trojan horse

64
Q

Bayesian filtering can help reduce this ubiquitous problem.

A

Spam

65
Q

Heuristic detection approaches in antimalware products include static analysis and dynamic analysis where an AV allows a piece of the suspected code to run in a sandbox or virtual machine, sometimes called an ____________ .

A

emulation buffer

66
Q

Which of the following would not be effective mitigation of zero-day attacks.

A. real-time dynamic analysis
B. heuristic detection
C. signature-based detection
D. behavior blocking

A

C

67
Q

Executes a malicious program when a certain set of conditions is met.

A

logic bomb

68
Q

What are RATs?

A

Remote Access Trojans

69
Q

Malware that is covertly installed on a target computer to gather sensitive information about a victim.

A

Spyware

70
Q

A virus requires a host to replicate. This malicious code does not.

A

Worm

71
Q

This type of virus hides the modifications it has made to files or boot records. It can use tunneling tactics or other tactics to hide it’s footprint and activities.

A

Stealth virus

72
Q

This type of virus produces varied but operational copies of itself in an attempt to defeat virus scans.

A

Polymorphic virus

73
Q

Object-Oriented programming (OOP) works with classes and objects. Table, chair, couch are objects of the class furniture. The class has a set of attributes, like color, dimension, weight, style, and cost. The attributes apply to all object members in the class. This is also called _____________.

A

instantiated

74
Q

Software written in OOP has requests sent to it, usually from another object, which creates another object to carry out some sort of functionality. The object can even be indifferent programming languages as long as the requesting object knows the API.

A

Just FYI

75
Q

What benefit of OOP does this describe?

The internal components of an object can be redefined without changing other parts of the system.

A. Modularity
B. Deferred Commitment
C. Reusability
D. Naturalness

A

Deferred Commitment

The internal components of an object can be redefined without changing other parts of the system.

76
Q

What benefit of OOP does this describe?

The building blocks of software are autonomous objects, cooperating through the exchange of messages.

A. Modularity
B. Deferred Commitment
C. Reusability
D. Naturalness

A

Modularity

77
Q

What benefit of OOP does this describe?

Object-oriented analysis, design, and modeling map to business needs and solutions.

A. Modularity
B. Deferred Commitment
C. Reusability
D. Naturalness

A

Naturalness

78
Q

What benefit of OOP does this describe?

Classes are reused by other programs, though they may be refined through inheritance.

A. Modularity
B. Deferred Commitment
C. Reusability
D. Naturalness

A

Resusability

79
Q

In OOP, this is the functionality or procedure an object can carry out

A

method

80
Q

Objects ____________ the attribute values, which means this information is packaged under one name and can be reused as one entity by other objects.

A

encapsulate

81
Q

This is also what encapsulation provides in OOP. Objects can have a “shared” portion which is the API. The “private” portion of how it actually works.

A

data hiding

82
Q

ISC2 defines this as “Two (different) objects can receive the same input and have different outputs.”

A

Polymorphism

83
Q

The process of classifying objects that will be appropriate for a solution. A problem is analyzed to determine the classes of objects to be used in the application.

A. Data Structure
B. Data Modeling
C. Object-oriented analysis (OOA)
D. Object-oriented design (OOD)

A

OOA

Object-oriented analysis

84
Q

This creates a representation of a real-world problem and maps it to a software solution using OOP.

A. Data Structure
B. Data Modeling
C. Object-oriented analysis (OOA)
D. Object-oriented design (OOD)

A

OOD

Object-oriented design

85
Q

The logical relationship between data elements.

A. Data Structure
B. Data Modeling
C. Object-oriented analysis (OOA)
D. Object-oriented design (OOD)

A

Data Structure

86
Q

A process used to define and analyze data requirements needed to support the business processes within the scope of corresponding systems and software application.

A. Data Structure
B. Data Modeling
C. Object-oriented analysis (OOA)
D. Object-oriented design (OOD)

A

Data Modeling

87
Q

If a module carries out only one task or tasks that are very similar it is said to have high _________ . This is good because it’ll be easier to update or modify without affecting other modules.

A

cohesion

88
Q

This is a measurement that indicates how much interaction one module requires to carry out its tasks. The lower the better… lower meaning it does not need to communicate with many other modules.

A

coupling

89
Q

This manages communication between objects and enables them to interact in a heterogeneous and distributed environment.

A. Component Object Model (COM)
B. Object request broker (ORB)
C. Object Linking and embedding (OLE)
D. Common Object Request Broker Architecture (CORBA)

A

Object request broker (ORB)

90
Q

This provides a standardized way for objects within different applications, platforms, and environments to communicate. It accomplishes this by providing standards for interfaces between objects.

A. Component Object Model (COM)
B. Object request broker (ORB)
C. Object Linking and embedding (OLE)
D. Common Object Request Broker Architecture (CORBA)

A

Common Object Request Broker Architecture (CORBA)

91
Q

This provides an architecture for components to interact on a local system. The distributed version uses the same interfaces, but enables components to interact over a distributed, or networked, environment.

A. Component Object Model (COM)
B. Object request broker (ORB)
C. Object Linking and embedding (OLE)
D. Common Object Request Broker Architecture (CORBA)

A

Component Object Model (COM)

DCOM = Distributed COM

92
Q

Enables a program to call another program (linking) and permits a piece of data to be inserted inside another program or document (embedding).

A. Component Object Model (COM)
B. Object request broker (ORB)
C. Object Linking and embedding (OLE)
D. Common Object Request Broker Architecture (CORBA)

A

Object Linking and embedding (OLE)

CISSP Study (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions