stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Security Policy Flashcards | StudBud
Explore
/
Security Policy
Security Policy
12 terms
·
StudBud Administration
·
11 plays
How much do you know about THE RULES?
Flashcards
12 cards
F
Practice quiz
P
Host live
L
Questions
12
Answers
1
How long may a symmetric authentication key be used before it must be changed?
1 year
5 years
60 minutes
2 years
2
How does QM411 Data Handling Policy classify data
PCI, PII, Other
Private, Confidential, Public
Security-sensitive, PII, Hidden
Classified, Top Secret, Public
3
Static code scans (Checkmarx) are required
Twice yearly for all apps
Twice yearly for PII web apps
Yearly for all apps
Yearly for web apps, twice yearly for PCI web apps
4
Who must take secure development training each year?
Developers, Testers, Managers, and Architects
Developers, Architects and Managers
Developers and Testers
Developers and Doc Writers
5
Which of these must approve Open Source before it is used in the company?
Legal
Platform Architecture
Secure Development
Ken Kennedy
6
Systems should use Role Based Access Control. What is Role Based Access Control
Users have 1 or more roles. Roles list security permissions
Security levels use names instead of numbers
Security is based on the user's role in Active Directory
Security based on the computer's role in Active Directory
7
Which of these Open Source licenses is OK for use internally and in any products?
GNU General Public License 2.0
Artistic 2.0 Copyleft
BSD
GNU Library or “Lesser” General Public (LGPL)
8
Systems must fail securely. This means:
A failing system must show config info for debugging
When a system fails, it must protect information anyway
The system should fail when a user uses invalid credentials
A system must destroy it's hard drive if the software dies
9
Which of these is an approved encryption cipher?
AES256
Triple DES
Blowfish
RC4
10
Audit logs should contain?
Sensitive Data
Failed authentications
Authentication actions
Activity date, time, identifying what, when, where, and who
11
The tool we use for Open Source tracking and approvals is known as
Black Duck CodeCenter
WhiteSource
OSS Master
Jira
12
Which of these is not a CSG policy?
QM302 Application Penetration Testing Policy
QM406 Network-enabled Application Security Policy
QM1653 Secure Software Development Policy
QM401 Encryption Policy
