Secure Software Development Exam
Bank
Course Introduction
Secure Software Development focuses on the integration of security principles and best practices throughout the software development lifecycle. Students will learn about common software vulnerabilities, threat modeling, and methods to mitigate risks through secure coding techniques, code reviews, and secure architecture design. The course covers industry standards and frameworks, such as OWASP Top Ten and Secure Development Lifecycle (SDL), and emphasizes the importance of continuous monitoring, testing, and updating of software applications to address evolving security challenges. Through hands-on exercises and real-world case studies, learners gain practical skills to design, develop, and maintain robust, secure software solutions.
Recommended Textbook
Cryptography and Network Security 6th Edition by William Stallings
Available Study Resources on Quizplus
20 Chapters
842 Verified Questions
842 Flashcards
Source URL: https://quizplus.com/study-set/3983 Page 2
Chapter 1: Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80023
Sample Questions
Q1) The OSI security architecture was not developed as an international standard,therefore causing an obstacle for computer and communication vendors when developing security features.
A)True
B)False
Answer: False
Q2) An)__________ is a potential for violation of security,which exists when there is a circumstance,capability,action or event that could breach security and cause harm.
A)threat
B)attack
C)risk
D)attack vector
Answer: A
Q3) All the techniques for providing security have two components: a security- related transformation on the information to be sent and some secret information shared by the two principals.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
Page 3
Chapter 2: Classical Encryption Techniques
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80022
Sample Questions
Q1) The task of making large quantities of random keys on a regular basis and distributing a key of equal length to both sender and receiver for every message sent are difficulties of the __________ scheme.
Answer: one-time pad
Q2) With the use of symmetric encryption,the principal security problem is maintaining the secrecy of the key.
A)True
B)False
Answer: True
Q3) The process of converting from plaintext to ciphertext is known as deciphering or decryption.
A)True
B)False
Answer: False
Q4) Steganography renders the message unintelligible to outsiders by various transformations of the text.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Block Ciphers and the Data Encryption Standard
Available Study Resources on Quizplus for this Chatper
27 Verified Questions
27 Flashcards
Source URL: https://quizplus.com/quiz/80021
Sample Questions
Q1) An advantage of key-dependent S-boxes is that because they are not fixed,it is impossible to analyze the S-boxes ahead of time to look for weaknesses.
A)True
B)False
Answer: True
Q2) Key sizes of __________ or less are now considered to be inadequate.
A)128 bits
B)32 bits
C)16 bits
D)64 bits
Answer: D
Q3) The vast majority of network-based symmetric cryptographic applications make use of ________ ciphers.
A)linear
B)block
C)permutation
D)stream
Answer: B
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Basic Concepts in Number Theory and Finite
Fields
Available Study Resources on Quizplus for this Chatper
26 Verified Questions
26 Flashcards
Source URL: https://quizplus.com/quiz/80020
Sample Questions
Q1) A __________ g of a finite field F or order q is an element whose first q - 1 powers generate all the nonzero elements of F.
15.Consider a field F defined by a polynomial fx).An element b contained in F is called a __________ of the polynomial if fb)= 0.
Q2) A field is a set in which we can do addition,subtraction, multiplication and division without leaving the set.
A)True
B)False
Q3) GF stands for __________ field in honor of the mathematician who first studied finite fields.
Q4) In the context of abstract algebra we are usually not interested in evaluating a polynomial for a particular value of x.To emphasize this point the variable x is sometimes referred to as the __________ .
A)monic
B)constant
C)indeterminate
D)coefficient
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Advanced Encryption Standard
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80019
Sample Questions
Q1) At each horizontal point,State is the same for both encryption and decryption.
A)True
B)False
Q2) The Rijndael developers designed the expansion key algorithm to be resistant to known cryptanalytic attacks.
A)True
B)False
Q3) The first N - 1 rounds consist of four distinct transformation functions: SubBytes,ShiftRows,AddRoundKey,and __________ .
Q4) In AES,the arithmetic operations of addition,multiplication and division are performed over the finite field _________ .
A)Z<sub>p</sub>
B)a/b = ab<sup>-1</sup>)
C)GF2<sup>n</sup><sup>-1</sup>)
D)GF2<sup>8</sup>)
Q5) The National Institute of Standards and Technology chose the __________ design as the winning candidate for AES.
Q6) The forward substitute byte transformation,called _________ ,is a simple table lookup.
Page 7
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Block Cipher Operation
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/80018
Sample Questions
Q1) A __________ is a technique for enhancing the effect of a cryptographic algorithm or adapting the algorithm for an application,such as applying a block cipher to a sequence of data blocks or a data stream.
Q2) The output of the encryption function is fed back to the shift register in Output Feedback mode,whereas in ___________ the ciphertext unit is fed back to the shift register.
A)Cipher Block Chaining mode
B)Electronic Codebook mode
C)Cipher Feedback mode
D)Counter mode
Q3) __________ mode is suitable for parallel operation.Because there is no chaining,multiple blocks can be encrypted or decrypted simultaneously.Unlike CTR mode,this mode includes a nonce as well as a counter.
A)OFB
B)S-AES
C)3DES
D)XTS-AES
Q4) One of the most widely used multiple-encryption scheme is __________ .
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Random and Pseudorandom Number
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80017
Sample Questions
Q1) Two criteria used to validate that a sequence of numbers is random are uniform distribution and __________ .
Q2) The longer the keyword the more difficult the cryptanalysis.
A)True
B)False
Q3) Operating systems typically provide a built-in mechanism for generating random numbers.For example,__________ uses mouse and keyboard activity,disk I/O operations,and specific interrupts.
Q4) The Blum,Blum,Shub generator is referred to as a ____________ .
A)TRNG
B)OFB PRNG
C)QRN
D)CSPRBG
Q5) A __________ is used to produce a pseudorandom string of bits of some fixed length.
A)PRF
B)PRNG
C)OFB PRNG
D)TRNG
Q6) __________ is a stream cipher designed in 1987 by Ron Rivest for RSA Security.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: More Number Theory
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80016
Sample Questions
Q1) The _________ of a number is defined to be the power to which some positive base except 1)must be raised in order to equal the number.
Q2) An important requirement in a number of cryptographic algorithms is the ability to choose a large prime number.
A)True
B)False
Q3) Prime numbers play a _________ role in number theory.
A)minor
B)nonessential
C)critical
D)abbreviated
Q4) Two numbers are relatively prime if their greatest common divisor is _________ .
Q5) Although it does not appear to be as efficient as the Miller-Rabin algorithm,in 2002 a relatively simple deterministic algorithm that efficiently determines whether a given large number is a prime was developed.This algorithm is known as the _________ algorithm.
Q6) Two theorems that play important roles in public-key cryptography are Fermat's theorem and __________ theorem.
Q7) Two numbers are __________ if their greatest common divisor is 1.
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Public-Key Cryptography and Rsa
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80015
Sample Questions
Q1) The difficulty of attacking __________ is based on the difficulty of finding the prime factors of a composite number.
Q2) The scrambled message produced as output is the __________ .It depends on the plaintext and the key.
Q3) The most widely used public-key cryptosystem is __________ .
A)optimal asymmetric encryption
B)asymmetric encryption
C)RSA
D)DES
Q4) Asymmetric encryption utilizes only a public key for encryption and decryption.
A)True
B)False
Q5) The __________ scheme is a block cipher in which the plaintext and ciphertext are integers between 0 and n - 1 for some n.
Q6) Public-key encryption is also known as ___________ .
A)digital-key encryption
B)asymmetric encryption
C)one way time exchange encryption
D)optimal-key encryption
11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Other Public-Key Cryptosystems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80014
Sample Questions
Q1) A considerably larger key size can be used for ECC compared to RSA.
A)True
B)False
Q2) The addition operation in elliptic curve cryptography is the counterpart of modular multiplication in RSA,and multiple addition is the counterpart of __________ .
Q3) To form a cryptographic system using __________ we need to find a "hard-problem" corresponding to factoring the product of two primes or taking the discrete logarithm.
Q4) ECC is fundamentally easier to explain than either RSA or Diffie-Hellman.
A)True
B)False
Q5) The PRNG variable ___________ is defined in NIST SP 800-90 as a number associated with the amount of work required to break a cryptographic algorithm or system.
Q6) The security of ECC depends on how difficult it is to determine k given kP and P.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Page 12
Chapter 11: Cryptographic Hash Functions
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80013
Sample Questions
Q1) It is possible to use a hash function but no encryption for message authentication.
A)True
B)False
Q2) A good hash function has the property that the results of applying the function to a large set of inputs will produce outputs that are evenly distributed and apparently random.
A)True
B)False
Q3) A hash function that satisfies the properties of variable input size,fixed output size,efficiency,preimage resistant,second preimage resistant and __________ is referred to as a strong hash function.
Q4) Whirlpool is a popular cryptographic hash function.
A)True
B)False
Q5) Virtually all cryptographic hash functions involve the iterative use of a compression function.
A)True B)False
Q6) A message authentication code is also known as a __________ hash function.
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Message Authentication Codes
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80012
Sample Questions
Q1) The approach taken by the Transport Layer Security protocol and the Wireless Transport Layer Security Protocol involve invoking HMAC _________ for each block of output wi.
A)zero times
B)twice
C)three times
D)once
Q2) Message authentication is a mechanism or service used to verify the integrity of a message.
A)True
B)False
Q3) The essential elements of any pseudorandom number generator are a __________ and a deterministic algorithm for generating a stream of pseudorandom bits.
A)secret key
B)session key
C)seed value
D)stream encryption function
Q4) __________ assures that data received are exactly as sent and that the purposed identity of the sender is valid.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Digital Signatures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80011
Sample Questions
Q1) The __________ attack is where the attacker chooses a list of messages before attempting to break the user's signature scheme,independent of the user's public key.The attacker then obtains from the user valid signatures for the chosen messages.
Q2) To create a __________ a user calculates two quantities,r and s,that are functions of the public key components p,q,g),the user's private key x),the hash code of the message HM),and an additional integer k that should be generated randomly or pseudorandomly and be unique for each signing.
A)signature
B)hash authentication
C)secret key
D)global key
Q3) In the digital signature algorithm the user's __________ is represented by x,which is a random or pseudorandom integer with 0 < x < q.
A)per message secret number
B)private key
C)global key
D)public key
To view all questions and flashcards with answers, click on the resource link above.
Chapter 14: Key Management and Distribution
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80010
Sample Questions
Q1) Communication between end systems is encrypted using a _________ key.
A)session
B)master
C)permanent
D)message
Q2) Used in a variety of applications,__________ defines the format for public-key certificates.
Q3) If encryption is done at the __________ level a key is needed for every pair of users or processes that require communication.
Q4) A __________ defines the procedures needed to revoke digital certificates.
A)KDC
B)digital key
C)cryptographic key encryption
D)public key infrastructure
Q5) The directory entry for each certification authority includes two types of certificates: forward certificates and ___________ .
Q6) Session keys are transmitted in encrypted form using a __________ key that is shared by the key distribution center and an end system or user.
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: User Authentication Protocols
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80009
Sample Questions
Q1) User authentication is the basis for most types of access control and for user accountability.
A)True
B)False
Q2) Intended to provide an integrity check as part of the encryption operation,encryption in Kerberos Version 4 makes use of a nonstandard mode of DES known as ____________.It has been demonstrated that this mode is vulnerable to an attack involving the interchange of ciphertext blocks.
Q3) Any timestamp based procedure must allow for a window of time sufficiently large enough to accommodate network delays yet sufficiently small to minimize the opportunity for attack.
A)True
B)False
Q4) Kerberos provides a trusted third party authentication service that enables clients and servers to establish authenticated communication.
A)True
B)False
Q5) The ticket granting ticket is encrypted with a secret key known only to the AS and the
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: Network Access Control and Cloud Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80008
Sample Questions
Q1) The cloud provider in a private cloud infrastructure is responsible for both the infrastructure and the control.
A)True
B)False
Q2) _________ is a client computer that is attempting to access a network.
A)EAP peer
B)PSK
C)NAC
D)RAS
Q3) VLANs are common NAC enforcement methods.
A)True
B)False
Q4) With a ________ infrastructure,the cloud infrastructure is a composition of two or more clouds that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability.
Q5) The threat of data compromise decreases in the cloud.
A)True
B)False
Q6) __________ are third party audits of cloud services.
Page 18
To view all questions and flashcards with answers, click on the resource link above.
Chapter 17: Transport-Level Security
Available Study Resources on Quizplus for this Chatper
26 Verified Questions
26 Flashcards
Source URL: https://quizplus.com/quiz/80007
Sample Questions
Q1) The encryption of the compressed message plus the MAC must increase the content length by more than 1024 bytes.
A)True
B)False
Q2) _________ attacks include impersonating another user,altering messages in transit between client and server and altering information on a Web site.
A)Active
B)Passive
C)Shell
D)Psuedo
Q3) Two important SSL concepts are the SSL session and the SSL _________ .
Q4) Unlike traditional publishing environments,the Internet is three- way and vulnerable to attacks on the Web servers.
A)True
B)False
Q5) Phase 3 completes the setting up of a secure connection of the Handshake Protocol.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 18: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80006
Sample Questions
Q1) The __________ function is the logical function that determines when a station operating within a BSS is permitted to transmit and may be able to receive PDUs.
Q2) The master session key is also known as the __________ key.
A)AAA
B)GTK
C)MIC
D)STA
Q3) The PMK is used to generate the _________ which consists of three keys to be used for communication between a STA and AP after they have been mutually authenticated.
A)AAA Key
B)GTK
C)PTK
D)PSK
Q4) Derived from the GMK,the _________ is used to provide confidentiality and integrity protection for multicast/broadcast user traffic.
Q5) IEEE 802.11 is a standard for wireless LANs.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Electronic Mail Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80005
Sample Questions
Q1) S/MIME provides the following functions: enveloped data,signed data,clear signed data,and ________ .
Q2) PGP provides authentication through the use of _________ .
A)asymmetric block encryption
B)symmetric block encryption
C)radix-64
D)digital signatures
Q3) The __________ is a directory lookup service that provides a mapping between the name of a host on the Internet and its numerical address.
Q4) To enhance security an encrypted message is not accompanied by an encrypted form of the session key that was used for message encryption.
A)True
B)False
Q5) For the __________ subtype the order of the parts is not significant.
A)multipart/mixed
B)multipart/digest
C)multipart/alternative
D)multipart/parallel
Q6) PGP provides compression using the __________ algorithm.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Ip Security
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/80004
Sample Questions
Q1) _________ identifies the type of data contained in the payload data field by identifying the first header in that payload.
A)Security Parameters Index
B)Next Header
C)Sequence Header
D)Payload Data
Q2) The _________ payload allows peers to identify packet flows for processing by IPsec services.
A)Configuration
B)Vendor ID
C)Traffic Selector
D)Extensible Authentication Protocol
Q3) By implementing security at the IP level an organization can ensure secure networking not only for applications that have security mechanisms but also for the many security ignorant applications.
A)True
B)False
Q4) _________ mode is used when one or both ends of an SA are a security gateway, such as a firewall or router that implements IPsec.
To view all questions and flashcards with answers, click on the resource link above. Page 22