CSSLP

Question 1

The use of IF-THEN rules is characteristic of which of the followingtypes of software testing?

Accepted Answer

Logic

Question 2

Discontinuance of a software with known vulnerabilities with a newer version is an eg:of _ risk

Accepted Answer

Avoidance

Question 3

The maximumtime by which business operations need to be restored when there is a securitybreach

Accepted Answer

Recovery Time Objective (RTO)

Question 4

The final activity in the software acceptance process is the go/no go decision after __ Testing

Accepted Answer

User Acceptance Testing

Question 5

Code signing can provide all of the following except

Accepted Answer

Authentication of Users

Question 6

Most SCADA systems are susceptible to software attacks because

Accepted Answer

they were not initially implemented with security in mind

Question 7

Which of the following is LEAST likely to be detected using a codereview process?

Accepted Answer

Logic Flaws

Question 8

Disassemblers,Debuggers&Decompilers are used to find which of the following codevulnerabilities

Accepted Answer

Lack of reverse engineering protection

Question 9

During which phase of the software development lifecycle (SDLC) isthreat modeling initiated?

Accepted Answer

Design

Question 10

The organization that publishes the ten most critical web application security risks (Top Ten)

Accepted Answer

OWASP

Question 11

Penetration testing must be conducted with properly defined

Accepted Answer

rules of engagement

Question 12

Vulnerability scans are used to

Accepted Answer

detect the presence of loopholes & Weakness in the software

Question 13

Predictable execution means that the software demonstrates all the following qualities except

Accepted Answer

Authorization

Question 14

Verification provides insight into which of the following aspects of software assurance

Accepted Answer

Reliability

Question 15

The process of releasing hotfixes & updates to fix a recently reported vulnerability is knownas

Accepted Answer

Patching

Question 16

Which of the following MUST be addressed by software security requirements

Accepted Answer

Goals and objectives of the organization

Question 17

The process to determine the given development phase satisfies the conditions set in startphase

Accepted Answer

Verification

Question 18

Impersonation attacks such as MITM attacks in an Internet application is mitigated using proper

Accepted Answer

Session Management

Question 19

Data classification is a core activity that is conducted as part of whichof the following

Accepted Answer

Information Lifecycle Management

Question 20

Apps processing financial data need to use more than one factor to verify the requester access

Accepted Answer

Authentication

Question 21

The main reason the availability of software is considered critical in software security

Accepted Answer

Software issues can cause downtime to the business

Question 22

Database triggers are useful for providing which of the detective software assurance capability

Accepted Answer

Auditing

Question 23

Which of the following is a process threat in the software supply chain?

Accepted Answer

Insecure Code Transfer

Question 24

Verbose error messages and unhandled exceptions can result in which of the following threats

Accepted Answer

Information Disclosure

Question 25

The process of removing private information from sensitive data sets isreferred to as

Accepted Answer

Anonymization

Question 26

When passwords are stored in the database, the best defence against disclosure attack

Accepted Answer

Hashing

Question 27

Parity bit checking mechanisms can be used for all of the following except

Accepted Answer

Input Validation

Question 28

Security requirements to protect against Unauthorized disclosure of data is also known as

Accepted Answer

Confidentiality Requirements

Question 29

Checksum validation(CRC) can be used to satisfy which of the following requirements

Accepted Answer

Integrity

Question 30

Which of the following is a covert mechanism that assures confidentiality

Accepted Answer

Steganography

Question 31

Logging application events suchas failed login is an eg:of which of the following control type

Accepted Answer

Detective Control

Question 32

The use of Human physical characteristics such as IRISPatterns/fingerprints for Authentication

Accepted Answer

Biometric authentication

Question 33

The ability of software to restore itself to normal expected operations after a securitybreach

Accepted Answer

Recoverability

Question 34

____ of software is defined as the ability of the software to withstand attacker attempts

Accepted Answer

Resiliency

Question 35

which is of the following enforces availability requirements of the business or client?

Accepted Answer

Service Level Agreements (SLA)

Question 36

During a threat modeling exercise, the software architecture is reviewed to identify

Accepted Answer

Entry Points

Question 37

Process of embedding information into a digitalsignal.These signals can be audio/video, picture

Accepted Answer

Watermarking

Question 38

IPSec technology which helps in the secure transmission of Data operates in which OSI layer

Accepted Answer

Network Layer

Question 39

vinod is part of the author role as well as he is included in the approve role,This Violates

Accepted Answer

Separation of Duties

Question 40

__tools or techniques can be used in the white box testing of software for insider threats?

Accepted Answer

Source Code Anazlyzers

CSSLP

Questions 40

CSSLP

Questions 40