D487 - Secure Software Design Knowlege Check and Quiz
Studied by 0 people
Call Kai
Learn
Practice Test
Spaced Repetition
Match
Flashcards
Knowt Play1/76
There's no tags or description
Looks like no tags are added yet.
Name | Mastery | Learn | Test | Matching | Spaced |
|---|
No study sessions yet.
77 Terms
What are the two common best principles of software applications in the development process?
Quality Code & Secure Code
2 multiple choice options
What ensures that the user has the appropriate role and privilege to view data?
Authorization
3 multiple choice options
Which security goal is defined by "guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity"?
Integrity
3 multiple choice options
Which phase in an SDLC helps to define the problem and scope of any existing systems and determine the objectives of new systems?
Planning
3 multiple choice options
What happens during a dynamic code review?
Programmers monitor system memory, functional behavior, response times, and overall performance.
3 multiple choice options
How should you store your application user credentials in your application database?
Store credentials using salted hashes
3 multiple choice options
Which software methodology resembles an assembly-line approach?
Waterfall model
3 multiple choice options
Which software methodology approach provides faster time to market and higher business value?
Agile model
3 multiple choice options
In Scrum methodology, who is responsible for making decisions on the requirements?
Product Owner
3 multiple choice options
What is the product risk profile?
A security assessment deliverable that estimates the actual cost of the product
3 multiple choice options
A software security team member has been tasked with creating a deliverable that provides details on where and to what degree sensitive customer information is collected, stored, or created within a new product offering.
What does the team member need to deliver in order to meet the objective?
Privacy impact assessment
3 multiple choice options
A software security team member has been tasked with creating a threat model for the login process of a new product.What is the first step the team member should take?
Identify security objectives
3 multiple choice options
What are three parts of the STRIDE methodology?
Spoofing, Elevation, Tampering
3 multiple choice options
What is the reason software security teams host discovery meetings with stakeholders early in the development life cycle?
To ensure that security is built into the product from the start
3 multiple choice options
Why should a security team provide documented certification requirements during the software assessment phase?
Depending on the environment in which the product resides, certifications may be required by corporate or government entities before the software can be released to customers.
3 multiple choice options
What are two items that should be included in the privacy impact assessment plan regardless of which methodology is used?
Required process steps & Technologies and techniques
3 multiple choice options
What are the goals of each SDL deliverable? - Product Risk Profile
Estimate the actual cost of the product
3 multiple choice options
What are the goals of each SDL deliverable? -SDL project outline
Map security activities to the development schedule
3 multiple choice options
What are the goals of each SDL deliverable? - Threat profile
Guide security activities to protect the product from vulnerabilities
3 multiple choice options
What are the goals of each SDL deliverable? -List of third-party software
Identify the dependence on unmanaged software
3 multiple choice options
What is a threat action that is designed to illegally access and use another person's credentials?
Spoofing
3 multiple choice options
What are two steps of the threat modeling process?
Survey The application & Decompose the application
3 multiple choice options
What do the "A" and the first "D" in the DREAD acronym represent?
Damage & Affected Users
3 multiple choice options
Which shape indicates each type of flow diagram element? - External elements
Rectangle
3 multiple choice options
Which shape indicates each type of flow diagram element? - Data Store
Two Parallel horizontal lines
3 multiple choice options
Which shape indicates each type of flow diagram element? - Data Flow
Solid Line with an arrow
3 multiple choice options
Which shape indicates each type of flow diagram element? - Trust Boundry
Dashed Line
3 multiple choice options
What are the two deliverables of the Architecture phase of the SDL?
Threat Modeling artifacts & Policy compliance analysis
3 multiple choice options
What SDL security assessment deliverable is used as an input to an SDL architecture process?
Threat profile
3 multiple choice options
Which software security testing technique tests the software from an external perspective?
Black box
3 multiple choice options
Which security design principle states that an entity should be given the minimum privileges and resources for a minimum period of time for a task?
Least privilege
3 multiple choice options
After the developer is done coding a functionality, when should code review be completed?
Within hours or the same day
3 multiple choice options
What is the order that code reviews should follow in order to be effective? - Step 1
Identify security code review objectives
3 multiple choice options
What is the order that code reviews should follow in order to be effective? - Step 2
Preform preliminary scan
3 multiple choice options
What is the order that code reviews should follow in order to be effective? - Step 3
Review code for security issues
3 multiple choice options
What is the order that code reviews should follow in order to be effective? - Step 4
Review for security issues unique to the architecture
3 multiple choice options
When a software application handles personally identifiable information (PII) data, what will be the Privacy Impact Rating?
P1: High privacy risk
3 multiple choice options
Which key success factor identifies threats to the software?
Effective threat modeling
3 multiple choice options
What is the goal of design security review deliverables?
To make modifications to the design of software components based on security assessments
3 multiple choice options
Which application scanner component is useful in identifying vulnerabilities such as cookie misconfigurations and insecure configuration of HTTP response headers?
Passive scanner
3 multiple choice options
Which type of attack occurs when an attacker uses malicious code in the data sent in a form?
Cross-site scripting
3 multiple choice options
Which tools provide the given functions? - Self Managed Automatic Code Review Product
SonarQube
3 multiple choice options
Which tools provide the given functions? - Proprietary issue tracking product
JIRA
3 multiple choice options
Which tools provide the given functions? - Open-source automation server
Jenkins
3 multiple choice options
Which tools provide the given functions? - AI-Powered managemnt soltuion
Dynatrace
3 multiple choice options
A new application is released, and users perform initial testing on the application.
Which type of testing are the users performing?
Beta Testing
What is a non-system-related component in software security testing attack surface validation?
Users
3 multiple choice options
When an application's input validation is not handled properly, it could result in which kind of vulnerabilities?
SQL injection, cross-site scripting
3 multiple choice options
What are the advantages of the following security analysis tools? - Static Code Analysis
Access to the actual instructions the software will be guessing
2 multiple choice options
What are the advantages of the following security analysis tools? - Dynamic Code Analysis
Tests a specific operational deployment
3 multiple choice options
What are the advantages of the following security analysis tools? - Fuzz Testing
Testing in a random approach
3 multiple choice options
What are the advantages of the following security analysis tools? - Manual Code Review
Requires no supporting Technology
3 multiple choice options
Which activity in the Ship (A5) phase of the security development cycle sets requirements for quality gates that must be met before release?
A5 policy compliance analysis
3 multiple choice options
Which post-release support activity should be completed when companies are joining together?
Security architectural reviews
3 multiple choice options
The company's website uses querystring parameters to filter products by category. The URL, when filtering on a product category, looks like this: company.com/products?category=2.
If the security team saw a URL of company.com/products?category=2 OR 1=1 in the logs, what assumption should they make?
An attacker is attempting to use SQL injection to gain access to information.
3 multiple choice options
Which post-release support activity (PRSA) details the process for investigating, mitigating, and communicating findings when security vulnerabilities are discovered in a software product?
External vulnerability disclosure response
3 multiple choice options
Which post-release support key success factor says that any change or component reuse should trigger security development life cycle activities?
SDL cycle for any architectural changes or code reuses
3 multiple choice options
Which step will you find in the SANS Institute Cyber Defense seven-step recipe for conducting threat modeling and application risk analysis?
Brainstorm threats from adversaries
3 multiple choice options
In which OpenSAMM core practice area would one find environment hardening?
Deployment
3 multiple choice options
Which practice in the Ship (A5) phase of the security development cycle verifies whether the product meets security mandates?
A5 policy compliance analysis
3 multiple choice options
Which post-release support activity defines the process to communicate, identify, and alleviate security threats?
PRSA1: External vulnerability disclosure response
3 multiple choice options
What are two core practice areas of the OWASP Security Assurance Maturity Model (OpenSAMM)?
Governance & Construction
3 multiple choice options
Which practice in the Ship (A5) phase of the security development cycle uses tools to identify weaknesses in the product?
Vulnerability Scan
3 multiple choice options
How can you establish your own SDL to build security into a process appropriate for your organization's needs based on the given environments? - Cloud
API invocation processes
3 multiple choice options
Which of the Ship (A5) deliverables of the security development cycle are performed with the given actions? - A5 Policy Compliance Analysis
Analyze activities and standards
3 multiple choice options
Which of the Ship (A5) deliverables of the security development cycle are performed with the given actions? - Code-assisted penetration testing
White-Box Security test
3 multiple choice options
Which of the Ship (A5) deliverables of the security development cycle are performed with the given actions? - Open-Source Licensing Review
License Compliance
3 multiple choice options
Which of the Ship (A5) deliverables of the security development cycle are performed with the given actions? - Final Security Review
Release and ship
3 multiple choice options
How can you establish your own SDL to build security into a process appropriate for your organization's needs based on the given environments? - Agile
Iterative Development
3 multiple choice options
How can you establish your own SDL to build security into a process appropriate for your organization's needs based on the given environments? - Devops
Continues integration and continuous development
3 multiple choice options
Which business function of OpenSAMM is associated with the following core practices? - Verification
Code Review
3 multiple choice options
How can you establish your own SDL to build security into a process appropriate for your organization's needs based on the given environments? - Digital enterprise
Enables and improves business activities
3 multiple choice options
Which phase of penetration testing allows for remediation to be performed?
Deploy
3 multiple choice options
Which key deliverable occurs during post-release support?
Third-party reviews
3 multiple choice options
Which business function of OpenSAMM is associated with the following core practices? - Governance
Policy and Compliance
3 multiple choice options
Which business function of OpenSAMM is associated with the following core practices? - Construction
Threat Assessment
3 multiple choice options
Which business function of OpenSAMM is associated with the following core practices? - Deployment
Vulnerability management
3 multiple choice options