Secure Software Development Exam Solutions - 1078 Verified Questions

Secure Software Development Exam Solutions https://quizplus.com/study-set/3971 24 Chapters 1078 Verified Questions

Secure Software Development Exam Solutions Course Introduction Secure Software Development explores methodologies and best practices for designing, building, and maintaining software with strong security foundations. The course covers topics such as secure coding principles, threat modeling, vulnerability assessment, cryptography in applications, and secure software development lifecycle (SSDLC).

Students will learn how to identify and mitigate common software vulnerabilities, integrate security into agile and DevOps workflows, and comply with legal and regulatory standards. Through hands-on projects and real-world case studies, learners gain practical skills for developing robust, resilient applications that withstand modern cyber threats.

Recommended Textbook Computer Security Principles and Practice 2nd Edition by William Stallings

Available Study Resources on Quizplus 24 Chapters 1078 Verified Questions 1078 Flashcards Source URL: https://quizplus.com/study-set/3971

Page 2

Chapter 1: Computer Systems Overview Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79799

Sample Questions Q1)

Masquerade,falsification,and

repudiation

are

threat

actions

that

cause

__________ threat consequences.

A)unauthorized disclosure B)disruption C)deception D)usurpation Answer: C Q2) The OSI security architecture focuses on security attacks,__________,and services.

Answer: mechanisms Q3) An example of __________ is an attempt by an unauthorized user to gain access to a system by posing as an authorized user.

A)masquerade B)repudiation C)interception D)inference Answer: A Q4) Misappropriation and misuse are attacks that result in ________ threat consequences.

Answer: usurpation Page 3 To view all questions and flashcards with answers, click on the resource link above.

Chapter 2: Cryptographic Tools Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79788

Sample Questions Q1) There are two general approaches to attacking a symmetric encryption scheme: cryptanalytic attacks and __________ attacks.

Answer: brute-force Q2) The purpose of the DSS algorithm is to enable two users to securely reach agreement about a shared secret that can be used as a secret key for subsequent symmetric encryption of messages.

A)True B)False Answer: False Q3) Like the MAC,a hash function also takes a secret key as input.

A)True B)False Answer: False Q4) A __________ processes the plaintext input in fixed-size blocks and produces a block of ciphertext of equal size for each plaintext block.

Answer: block cipher Q5) The two criteria used to validate that a sequence of numbers is random are independence and _________ .

Answer: uniform distribution 4 click on the resource link above.

To view all questions and flashcards with Page answers,

Chapter 3: User Authentication Available Study Resources on Quizplus for this Chatper 44 Verified Questions 44 Flashcards Source URL: https://quizplus.com/quiz/79782

Sample Questions Q1) A token is the best means of authentication because it cannot be forged or stolen by an adversary.

A)True B)False Answer: False Q2) Voice pattern,handwriting characteristics,and typing rhythm are examples of __________ biometrics.

Answer: dynamic Q3) A __________ attack involves an adversary repeating a previously captured user response.

A)client B)Trojan horse C)replay D)eavesdropping Answer: C Q4) In a __________ attack,an application or physical device masquerades as an authentic

application

or

device

for

the

purpose

of

capturing

a

password,passcode,or biometric.

Answer: Trojan horse To view all questions and flashcards with answers, click on the resource link above.

Page 5

user

Chapter 4: Access Control Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79781

Sample Questions Q1) Role hierarchies make use of the concept of __________ to enable one role to implicitly include access rights associated with a subordinate role.

Q2) __________ provide a means of adapting RBAC to the specifics of administrative and security policies in an organization.

A)Constraints B)Mutually Exclusive Roles C)Cardinality D)Prerequisites Q3) T F 4.External devices such as firewalls cannot provide access control services.

A)True B)False Q4) The main innovation of the NIST standard is the introduction of the RBAC System and Administrative Functional Specification,which defines the features required for an RBAC system.

A)True B)False Q5) The authentication function determines who is trusted for a given purpose.

A)True B)False 6 click on the resource link above.

To view all questions and flashcards with Page answers,

Chapter 5: Database Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79780

Sample Questions Q1) A __________ is a suite of programs for constructing and maintaining the database and for offering ad hoc query facilities to multiple users and applications.

Q2) To create a relationship between two tables,the attributes that define the primary key in one table must appear as attributes in another table,where they are referred to as a foreign key.

A)True B)False Q3) The _________ model provides a predefined environment for the cloud subscriber that is shared with other tenants,typically through tagging data with a subscriber identifier.

Q4) _________ is a model for enabling ubiquitous,convenient,on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.

Q5) With ___________ administration the owner (creator)of a table may grant and revoke access rights to the table.

Q6) The __________ is a human entity that presents requests (queries)to the system.

Q7) In a relational database columns are referred to as _________.

Page 7 To view all questions and flashcards with answers, click on the resource link above.

Chapter 6: Malicious Software Available Study Resources on Quizplus for this Chatper 44 Verified Questions 44 Flashcards Source URL: https://quizplus.com/quiz/79779

Sample Questions Q1) The __________ is when the virus function is performed.

A)dormant phase B)propagation phase C)triggering phase D)execution phase Q2) A bot can use a __________ to capture keystrokes on the infected machine to retrieve sensitive information.

Q3) Keyware captures keystrokes on a compromised system.

A)True B)False Q4) A __________ is when a user views a Web page controlled by the attacker that contains a code that exploits the browser bug and downloads and installs malware on the system without the user's knowledge or consent.

Q5) During the __________ phase the virus is activated to perform the function for which it was intended.

Q6) A bot propagates itself and activates itself,whereas a worm is initially controlled from some central facility.

A)True B)False Page 8 To view all questions and flashcards with answers, click on the resource link above.

Chapter 7: Denial-Of-Service Attacks Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79778

Sample Questions Q1) A ______ triggers a bug in the system's network handling software causing it to crash and the system can no longer communicate over the network until this software is reloaded.

A)echo B)reflection C)poison packet D)flash flood Q2) Slowloris is a form of ICMP flooding.

A)True B)False Q3) Reflector and amplifier attacks use compromised systems running the attacker's programs.

A)True B)False Q4) A _____ is an action that prevents or impairs the authorized use of networks,systems,or applications by exhausting resources such as central processing units,memory,bandwidth,and disk space.

Q5) _____ attacks flood the network link to the server with a torrent of malicious packets competing with valid traffic flowing to the server.

9 click on the resource link above.

To view all questions and flashcards with Page answers,

Chapter 8: Intrusion Detection Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79777

Sample Questions Q1) Signature-based approaches attempt to define normal,or expected, behavior,whereas anomaly approaches attempt to define proper behavior.

A)True B)False Q2) The rule _______ tells Snort what to do when it finds a packet that matches the rule criteria.

A)protocol B)direction C)action D)destination port Q3) The purpose of the ________ module is to collect data on security related events on the host and transmit these to the central manager.

A)central manager agent B)LAN monitor agent C)host agent D)architecture agent Q4) An intruder can also be referred to as a hacker or cracker.

A)True B)False Q5) An IDS comprises three logical components: analyzers,user interface and _____.

Page 10 To view all questions and flashcards with answers, click on the resource link above.

Chapter 9: Firewalls and Intrusion Prevention Systems Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79776

Sample Questions Q1) An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.

Q2) An important aspect of a distributed firewall configuration is security monitoring.

A)True B)False Q3) One disadvantage of a packet filtering firewall is its simplicity.

A)True B)False Q4) __________ scans for attack signatures in the context of a traffic stream rather than individual packets.

A)Pattern matching B)Protocol anomaly C)Traffic anomaly D)Stateful matching Q5) A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.

Q6) Snort Inline adds three new rule types: drop,reject,and _________.

To view all questions and flashcards with Page answers, 11 click on the resource link above.

Chapter 10: Buffer Overflow Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79798

Sample Questions Q1) The only consequence of a buffer overflow attack is the possible corruption of data used by the program.

A)True B)False Q2) _______ defenses aim to detect and abort attacking existing programs.

Q3) _______ defenses involve changes to the memory management of the virtual address space of processes that act to either alter the properties of regions of memory or to make predicting the location of target buffers sufficiently difficult to thwart many types of attacks.

A)Buffer B)Position independent C)Run-time D)Compile-time Q4) The _________ project produces a free,multiplatform 4.4BSD-based UNIX-like operating system.

Q5) ________ attacks can occur in a binary buffer copy when the programmer has included code to check the number of bytes being transferred,but due to a coding error,allows just one more byte to be copied than there is space available.

Q6) ______ defenses aim to harden programs to resist attacks in new programs.

Page 12 To view all questions and flashcards with answers, click on the resource link above.

Chapter 11: Software Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79797

Sample Questions Q1) "Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Q2) Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Q3) If privileges are greater than those already available to the attacker the result is a _________.

Q4) The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

A)lock B)code injection C)chroot jail D)privilege escalation Q5) _________ attacks are most commonly seen in scripted Web applications.

Q6) The correct implementation in the case of an atomic operation is to test separately for the presence of the lockfile and to not always attempt to create it.

A)True B)False To view all questions and flashcards withPage answers, 13 click on the resource link above.

Chapter 12: Operating System Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79796

Sample Questions Q1) The aim of the specific system installation planning process is to maximize _______ while minimizing costs.

Q2) A malicious driver can potentially bypass many security controls to install malware.

A)True B)False Q3) ______ virtualization systems are typically seen in servers,with the goal of improving the execution efficiency of the hardware.

Q4) Backup and archive processes are often linked and managed together.

A)True B)False Q5) Unix and Linux systems grant access permissions for each resource using the ______ command.

Q6) Performing regular backups of data on a system is a critical control that assists with maintaining the integrity of the system and user data.

A)True B)False Q7) The three operating system security layers are: physical hardware,operating system kernel,and _________.

Page 14

To view all questions and flashcards with answers, click on the resource link above.

Chapter 13: Trusted Computing and Multilevel Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79795

Sample Questions Q1) A multilevel secure system for confidentiality must enforce: A)no read up B)ss-property C)no write down D)all of the above Q2) "An individual (or role)may grant to another individual (or role)access to a document based on the owner's discretion,constrained by the MAC rules" describes the _________.

A)ss-property B)ds-property C)*-property D)cc-property Q3) Security classes are referred to as __________.

A)security clearances B)security classifications C)security levels D)security properties Q4) To structure the need for assurance the CC defines a scale for rating assurance consisting of _____ evaluation assurance levels ranging from the least rigor and scope for assurance evidence to the most.

Page 15 To view all questions and flashcards with answers, click on the resource link above.

Chapter 14: It Security Management and Risk Assessment Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79794

Sample Questions Q1) Maintaining and improving the information security risk management process in response to incidents is part of the _________ step.

A)act B)plan C)check D)do Q2) The purpose of ________ is to determine the basic parameters within which the risk assessment will be conducted and then to identify the assets to be examined.

A)establishing the context B)control C)risk avoidance D)combining Q3) It is not critical that an organization's IT security policy have full approval or buy-in by senior management.

A)True B)False Q4) Not proceeding with the activity or system that creates the risk is _________.

Q5) The level of risk the organization views as acceptable is the organization's __________.

16 click on the resource link above.

To view all questions and flashcards withPage answers,

Chapter 15: It Security Controls, plans, and Procedures Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79793

Sample Questions Q1) The objective of the ________ control category is to counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption.

A)asset management B)business continuity management C)information security incident management D)physical and environmental security Q2) _________ is a formal process to ensure that critical assets are sufficiently protected in a cost-effective manner.

A)Configuration management control B)IT security management C)Detection and recovery control D)Security compliance Q3) The recommended controls need to be compatible with the organization's systems and policies.

A)True B)False Q4) ______ checking is an audit process to review the organization's security processes.

To view all questions and flashcards with answers, click on the resource link above.

Page 17

Chapter 16: Physical and Infrastructure Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79792

Sample Questions Q1) Physical security must also prevent any type of physical access or intrusion that can compromise logical security.

A)True B)False Q2) The security classification for a restricted area containing a security interest is _____.

A)controlled B)exclusion C)unrestricted D)limited Q3)

_______

facilities

include

electrical

power,communication

services,and

related

power

environmental controls such as heat and humidity.

A)Supporting B)Information C)Physical D)All of the above Q4)

_______

threats

encompass

threats

to

electrical

and

electromagnetic emission.

Q5) The most essential element of recovery from physical security breaches is ____.

18 click on the resource link above.

To view all questions and flashcards withPage answers,

Chapter 17: Human Resources Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79791

Sample Questions Q1) A(n)________ is any file or object found on a system that might be involved in probing or attacking systems and networks or that is being used to defeat security measures.

Q2) The principal problems associated with employee behavior are errors and omissions,_______,and actions by disgruntled employees.

Q3) Having all of the security functions and audit responsibilities reside in the same person is a wise decision on the part of the organization.

A)True B)False Q4) ________ lists the following security objective with respect to current employees: to ensure that employees,contractors,and third-party users are aware of information security threats and concerns and their responsibilities and liabilities with regard to information security and are equipped to support organizational security policy in the course of their normal work and to reduce the risk of human error.

Q5) Complying with regulations and contractual obligations is a benefit of security awareness,training,and education programs.

A)True B)False To view all questions and flashcards with answers, click on the resource link above.

Page 19

Chapter 18: Security Auditing Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79790

Sample Questions Q1) _________ audit trails are generally used to monitor and optimize system performance.

A)User-level B)Physical-level C)System-level D)All of the above Q2) ______ is detection of events within a given set of parameters,such as within a given time period or outside a given time period.

Q3) The basic audit objective is to establish accountability for system entities that initiate or participate in security-relevant events and actions.

A)True B)False Q4) ______ is the identification of data that exceed a particular baseline value.

A)Anomaly detection B)Real-time analysis C)Thresholding D)All of the above Q5) Protection of the audit trail involves both integrity and confidentiality.

A)True B)False

Page 20

To view all questions and flashcards with answers, click on the resource link above.

Chapter 19: Legal and Ethical Aspects Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79789

Sample Questions Q1) An example of a patent from the computer security realm is the RSA public-key cryptosystem.

A)True B)False Q2) _______ refers to a system of moral principles that relates to the benefits and harms of particular actions,and to the rightness and wrongness of motives and ends of those actions.

Q3) _____ can be copyrighted.

A)Dramatic works B)Architectural works C)Software-related works D)All of the above Q4) _____ strengthens the protection of copyrighted materials in digital format.

A)HIPPA B)DMCA C)WIPO D)DRM Q5) The _________ Act confers certain rights on individuals and obligations on credit reporting agencies.

21 Q6) The three types of patents are: utility Page patents,design patents,and ________.

To view all questions and flashcards with answers, click on the resource link above.

Chapter 20: Symmetric Encryption and Message Confidentiality Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79787

Sample Questions Q1) Unlike ECB and CBC modes,________ mode requires only the implementation of the encryption algorithm and not the decryption algorithm.

Q2) _________ is the process of attempting to discover the plaintext or key.

Q3) "The plaintext is 64 bits in length and the key is 56 bits in length; longer plaintext amounts are processed in 64-bit blocks" is a description of the DES algorithm.

A)True B)False Q4) An encryption scheme is _________ if the cost of breaking the cipher exceeds the value of the encrypted information and/or the time required to break the cipher exceeds the useful lifetime of the information.

Q5) The _______ module performs end-to-end encryption and obtains session keys on behalf of users.

A)PKM B)RCM C)SSM D)CCM Q6) The three most important symmetricPage block22ciphers are: 3DES,AES,and _____.

To view all questions and flashcards with answers, click on the resource link above.

Chapter 21: Public-Key Cryptography and Message Authentication Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79786

Sample Questions Q1) NIST has published FIPS PUB 186,which is known as the ___________.

Q2) SHA-2 shares the same structure and mathematical operations as its predecessors and this is a cause for concern.

A)True B)False Q3) The key exchange protocol is vulnerable to a man-in-the-middle attack because it does not authenticate the participants.

A)True B)False Q4) The evaluation criteria for the new hash function are: security,_______,and algorithm and implementation characteristics.

Q5) SHA-3 algorithms must be designed to resist any potentially successful attack on SHA-2 functions.

A)True B)False Q6) One of the first public-key schemes,_______,was developed in 1977 by Ron Rivest,Adi Shamir,and Len Adleman.

Page 23

Q7) Perhaps the most widely used public-key algorithms are _________ and Diffie-Hellman.

Q8) One of the simplest hash functions is the ________ of every block.

To view all questions and flashcards with answers, click on the resource link above.

Page 24

Chapter 22: Internet Security Protocols and Standards Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79785

Sample Questions Q1) _______ is a list that contains the combinations of cryptographic algorithms supported by the client.

A)Compression method B)Session ID C)CipherSuite D)All of the above Q2) The ________ accepts the message submitted by a message user agent and enforces the policies of the hosting domain and the requirements of Internet standards.

A)mail submission agent B)message user agent C)mail delivery agent D)message transfer agent Q3) At its most fundamental level the Internet mail architecture consists of a user world in the form of _________.

A)MHS B)MSA C)MUA D)MDA Q4) The _________ is used to convey SSL-related alerts to the peer entity.

To view all questions and flashcards with answers, click on the resource link above.

Page 25

Chapter 23: Internet Authentication Applications Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79784

Sample Questions Q1) The principal objective for developing a PKI is to enable secure, convenient,and efficient acquisition of private keys.

A)True B)False Q2) An obvious security risk is that of impersonation.

A)True B)False Q3) _______ is the process whereby a user first makes itself known to a CA prior to that CA issuing a certificate or certificates for that user.

A)Authorization B)Registration C)Certification D)Initialization Q4) ________ allows end entities to restore their encryption/decryption key pair from an authorized key backup facility.

Q5) In a generic identity management architecture a ________ is an identity holder.

Q6) The focus of _________ is defining an identity for each user,associating attributes with the identity,and enforcing a means by which a user can verify identity.

To view all questions and flashcards withPage answers, 26 click on the resource link above.

Chapter 24: Wireless Network Security Available Study Resources on Quizplus for this Chatper 45 Verified Questions 45 Flashcards Source URL: https://quizplus.com/quiz/79783

Sample Questions Q1) A system used to interconnect a set of basic service sets and LANs to create an extended service set is a _________.

A)distribution system B)coordination function C)MAC data unit D)wireless access system Q2) In order to accelerate the introduction of strong security into WLANs the Wi-Fi Alliance promulgated ________,a set of security mechanisms that eliminates most 802.11 security issues,as a Wi-Fi standard.

A)WPA B)WEP C)RSN D)MAC Q3) CRC is an error detecting code.

A)True B)False Q4) The fields preceding the MSDU field are referred to as the _________.

Q5) The lowest layer of the IEEE 802 reference model is the __________ layer.

Q6) Like TKIP,CCMP provides two services: message integrity and ________.

Page 27 Q7) At the top level of the group key hierarchy is the ___________.

To view all questions and flashcards with answers, click on the resource link above.