CISSP : Certified Information Systems Security Professional : Part 23

CISSP : Certified Information Systems Security Professional : Part 23

1. Which of the following is a benefit in implementing an enterprise Identity and Access Management (IAM) solution?

   • Password requirements are simplified.
   • Risk associated with orphan accounts is reduced.
   • Segregation of duties is automatically enforced.
   • Data confidentiality is increased.

2. Which of the following statements is TRUE regarding state-based analysis as a functional software testing technique?

   • It is characterized by the stateless behavior of a process implemented in a function
   • Test inputs are obtained from the derived boundaries of the given functional specifications
   • An entire partition can be covered by considering only one representative value from that partition
   • It is useful for testing communications protocols and graphical user interfaces

3. Which of the following are important criteria when designing procedures and acceptance criteria for acquired software?

   • Code quality, security, and origin 
   • Architecture, hardware, and firmware
   • Data quality, provenance, and scaling
   • Distributed, agile, and bench testing

4. Which of the following steps should be performed FIRST when purchasing Commercial Off-The-Shelf (COTS) software?

   • undergo a security assessment as part of authorization process
   • establish a risk management strategy
   • harden the hosting server, and perform hosting and application vulnerability scans
   • establish policies and procedures on system and services acquisition 

5. An organization has outsourced its financial transaction processing to a Cloud Service Provider (CSP) who will provide them with Software as a Service (SaaS). If there was a data breach who is responsible for monetary losses?

   • The Data Protection Authority (DPA)
   • The Cloud Service Provider (CSP)
   • The application developers
   • The data owner 

6. What is the PRIMARY role of a scrum master in agile development?

   • To choose the primary development language
   • To choose the integrated development environment
   • To match the software requirements to the delivery plan
   • To project manage the software delivery 

7. What capability would typically be included in a commercially available software package designed for access control?

   • Password encryption 
   • File encryption
   • Source library control
   • File authentication

8. An organization plan on purchasing a custom software product developed by a small vendor to support its business model.

   Which unique consideration should be made part of the contractual agreement potential long-term risks associated with creating this dependency?

   • A source code escrow clause
   • Right to request an independent review of the software source code 
   • Due diligence form requesting statements of compliance with security requirements
   • Access to the technical documentation

9. When developing solutions for mobile devices, in which phase of the Software Development Life Cycle (SDLC) should technical limitations related to devices be specified?

   • Implementation 
   • Initiation
   • Review
   • Development

10. Which of the following is the MOST important security goal when performing application interface testing?

    • Confirm that all platforms are supported and function properly
    • Evaluate whether systems or components pass data and control correctly to one another 
    • Verify compatibility of software, hardware, and network connections
    • Examine error conditions related to external interfaces to prevent application details leakage

11. Which of the following is the MOST common method of memory protection?

    • Compartmentalization
    • Segmentation 
    • Error correction
    • Virtual Local Area Network (VLAN) tagging

12. Attack trees are MOST useful for which of the following?

    • Determining system security scopes 
    • Generating attack libraries
    • Enumerating threats
    • Evaluating Denial of Service (DoS) attacks

13. Which of the following techniques is known to be effective in spotting resource exhaustion problems, especially with resources such as processes, memory, and connections?

    • Automated dynamic analysis 
    • Automated static analysis
    • Manual code review
    • Fuzzing

14. Which one of the following is an advantage of an effective release control strategy form a configuration control standpoint?

    • Ensures that a trace for all deliverables is maintained and auditable 
    • Enforces backward compatibility between releases
    • Ensures that there is no loss of functionality between releases
    • Allows for future enhancements to existing features

15. The design review for an application has been completed and is ready for release. What technique should an organization use to assure application integrity?

    • Application authentication
    • Input validation
    • Digital signing 
    • Device encryption

16. Why is lexical obfuscation in software development discouraged by many organizations?

    • Problems compiling the code
    • Problems writing test cases
    • Problems maintaining data connections
    • Problems recovering systems after disaster

17. Which of the following is the BEST technique to facilitate secure software development?

    • Adhere to secure coding practices for the software application under development
    • Conduct penetrating testing for the software application under development
    • Develop a threat modeling review for the software application under development
    • Perform a code review process for the software application under development

18. What is the purpose of code signing?

    • The signer verifies that the software being loaded is the software originated by the signer
    • The vendor certifies the software being loaded is free of malicious code and that it was originated by the signer
    • The signer verifies that the software being loaded is free of malicious code
    • Both vendor and the signer certify the software being loaded is free of malicious code and it was originated by the signer

19. Which of the following is used to support the concept of defense in depth during the development phase of a software product?

    • Maintenance hooks
    • Polyinstantiation
    • Known vulnerability list
    • Security auditing

20. Which of the following practices provides the development team with a definition of security and identification of threats in designing software?

    • Penetration testing
    • Stakeholder review
    • Threat modeling
    • Requirements review