Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP PREP > Software Development Security > Flashcards

Software Development Security Flashcards

1
Q

Object-oriented programming typically uses ——–design

A

bottom-up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Freeware is “free as in beer” (gratis) software

A

free to use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Shareware is fully functional proprietary software that may be initially used free of charge.

A

Shareware for a specific period of time specified by the license

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Crippleware

A

s partially functioning proprietary software, often with key features disabled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The most prevalent of open source licenses

A

GPL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Waterfall Model

A

it cannot go back up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The Sashimi Model

A

based on (and a reaction to) the Waterfall Model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Agile methods include

A

Scrum and Extreme Programming (XP).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Extreme Programming (XP) is an Agile development method that uses pairs of programmers who work off a detailed specification. There is a high level of customer involvement.

A

Extreme Programming improves a software project in five essential ways, communication, simplicity, feedback, respect, and courage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The Spiral Model

A

The Spiral Model is a software development model designed to control risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Rapid Application Development (RAD)

A

The goal of RAD is quickly meeting the business need of the system; technical concerns are secondary. The customer is heavily involved in the process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The Systems Development Life Cycle

A

initiation, development/acquisition, implementation, operation, and disposal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An Integrated Product Team (IPT)

A

is a customer-focused group that focuses on the entire lifecycle of a project:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Configuration Change Control

A

process for managing updates to the baseline configurations for the configuration items; and

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Aggregation attack

A

is a mathematical attack where an attacker aggregates details at a lower classification to determine information at a higher classification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Inference

A

but the attacker must logically deduce missing details: unlike aggregation, a mystery must be solved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

tuple

A

a row is a database record,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Referential integrity

A

means that every foreign key in a secondary table matches a primary key in the parent table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Semantic integrity

A

each attribute (column) value is consistent with the attribute data type.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Entity integrity

A

means each tuple has a unique primary key that is not null.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Database normalization

A

seeks to make the data in a database table logically concise, organized, and consistent.

22
Q

data dictionary

A

description of the database tables

23
Q

database schema

A

it describes the attributes and values of the database tables.

24
Q

Data Definition Language (DDL)

A

DDL is used to create, modify, and delete tables.

25
Q

Data Manipulation Language (DML).

A

DML is use to query and update data stored in the tables.

26
Q

Database replication

A

mirrors a live database, allowing simultaneous reads and writes to multiple replicated databases by clients

27
Q

A shadow database

A

a shadow database mirrors all changes made to a primary database, but clients do not access the shadow

28
Q

Object-Oriented Programming (OOP)

A

changes the older structured programming methodology, and treats a program as a series of connected objects that communicate via messages

29
Q

polyinstantiation

A

means “many instances,” two instances (specific objects) with the same names that contain different data.

30
Q

Inheritance

A

Addy inherits an understanding of numbers and math from his parent class mathematical operators.

31
Q

Object Request Brokers (ORBs)

A

Common object brokers included COM, DCOM, and CORBA.

32
Q

COM

A

locates objects on a local system;

33
Q

DCOM

A

can also locate objects over a network.

34
Q

Common Object Request Broker Architecture (CORBA)

A

CORBA competes with Microsoft’s proprietary DCOM

35
Q

Object-Oriented Analysis (OOA) and Object-Oriented Design (OOD)

A

Object-Oriented Analysis (OOA) seeks to understand (analyze) a problem domain (the challenge you are trying to address) and identifies all objects and their interaction. Object-Oriented Design (OOD) then develops (designs) the solution.

36
Q

Software Capability Maturity Model (CMM)

A

maturity framework for evaluating and improving the software development process

37
Q

The five levels of CMM are described

A

Initial,Repeatable,Defined,Managed,Optimizing

38
Q

Acceptance testing

A

tests whether software meets various end-state requirements, from a user or customer, contract or compliance perspective

39
Q

Acceptance testing

A

tests whether software meets various end-state requirements, from a user or customer, contract or compliance perspective

40
Q

Expert systems consist of two main components

A

The first is a knowledge base that consists of “if/then” statements. These statements contain rules that the expert system uses to make decisions. The second component is an inference engine that follows the tree formed by the knowledge base, and fires a rule when there is a match.

41
Q

Request Control

A

The request control process provides an organized framework within which users can request modifications, managers can conduct cost/benefit analysis, and developers can prioritize tasks.

42
Q

Change Control

A

The change control process is used by developers to re-create the situation encountered by the user and analyze the appropriate changes to remedy the situation. It also provides an organized framework within which multiple developers can create and test a solution prior to rolling it out into a production environment. Change control includes conforming to quality control restrictions, developing tools for update or change deployment, properly documenting any coded changes, and restricting the effects of new code to minimize diminishment of security.

43
Q

White-Box Testing

A

hite-box testing examines the internal logical structures of a program and steps through the code line by line, analyzing the program for potential errors.

44
Q

Black-Box Testing

A

Black-box testing examines the program from a user perspective by providing a wide variety of input scenarios and inspecting the output. Black-box testers do not have access to the internal code. Final acceptance testing that occurs prior to system delivery is a common example of black-box testing.

45
Q

Gray-Box Testing

A

Gray-box testing combines the two approaches and is popular for software validation. In this approach, testers examine the software from a user perspective, analyzing inputs and outputs. They also have access to the source code and use it to help design their tests. They do not, however, analyze the inner workings of the program during their testing.

46
Q

Static Testing

A

Static testing evaluates the security of software without running it by analyzing either the source code or the compiled application.

47
Q

Dynamic Testing D

A

ynamic testing evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else

48
Q

Atomicity

A

Database transactions must be atomic—that is, they must be an “all-or-nothing” affair. If any part of the transaction fails, the entire transaction must be rolled back as if it never occurred.

49
Q

Consistency

A

All transactions must begin operating in an environment that is consistent with all of the database’s rules (for example, all records have a unique primary key). When the transaction is complete, the database must again be consistent with the rules, regardless of whether those rules were violated during the processing of the transaction itself. No other transaction should ever be able to use any inconsistent data that might be generated during the execution of another transaction.

50
Q

Isolation

A

The isolation principle requires that transactions operate separately from each other. If a database receives two SQL transactions that modify the same data, one transaction must be completed in its entirety before the other transaction is allowed to modify the same data. This prevents one transaction from working with invalid data generated as an intermediate step by another transaction.

51
Q

Durability

A

Database transactions must be durable. That is, once they are committed to the database, they must be preserved. Databases ensure durability through the use of backup mechanisms, such as transaction logs

CISSP PREP (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions