Domain 8 (Software Development Security)

Question 1

What is IPv6 secured by (i’ts built in)?

Answer 1

IPSec

Question 2

What is the Waterfall Software Development Methodology?

Answer 2

Stage by stage phase approach focused on deliverables at the end of each phase

Question 3

What are the four Software Development Methodologies?

Answer 3

Waterfall
Prototype
Spiral
Agile

Question 4

What are the advantages to the Waterfall Software Development Methodology?

Answer 4

Each phase has a specific deliverable and review process. Best for small projects. Define before design.

Question 5

What are the disadvantages to the Waterfall Software Development Methodology?

Answer 5

Can’t adjust scope during life cycle. High risk. Poor model for long term projects.

Question 6

What are the advantages of Prototyping Software Development Methodology?

Answer 6

Get client feedback early on in project.

Question 7

What are the disadvantages of Prototyping Software Development Methodology?

Answer 7

Clients rarely understand impact of proposed changes. Developers may use shortcuts to create prototype.

Question 8

What is the Spiral Software Development Methodology?

Answer 8

Combination of Waterfall and Prototyping.

Question 9

What are the advantages of Spiral Software Development Methodology?

Answer 9

High amount of risk analysis. Software produced early in life cycle.

Question 10

What are the disadvantages of Spiral Software Development Methodology?

Answer 10

Can be costly. Highly dependent on risk analysis phase.

Question 11

What are the five stages of Agile Software Development Methodology?

Answer 11

Brainstorm
Design
Development
Quality Assurance
Deployment

Question 12

What are the advantages of Agile Software Development Methodology?

Answer 12

Fewer defects, highly flexible, immediate feedback

Question 13

What are the disadvantages of Agile Software Development Methodology?

Answer 13

Less documentation

Question 14

What is Service Orientated Architecture?

Answer 14

Services and functions should be modular and run independently from one another. Vendor neutral functionality.

Question 15

What is Aggregation and Inference?

Answer 15

Aggregation is collection data and Inference is making an assumption based on the aggregated data

Question 16

What is Polyinstantiation?

Answer 16

Multiple instances of information. One version available lower clearance, higher clearance sees real data.

Question 17

What are the five elements of good monitoring?

Answer 17

Consistency
Quantitative
Objective
Relevance
Inexpensive

Question 18

What is Insecure Direct Object Reference?

Answer 18

Data disclosure by changing parameters (user?acct=6065)

Question 19

What are the two types of Input Sanitation?

Answer 19

Stripping

Substitution

Question 20

What does Stripping Input Sanitation do?

Answer 20

Removes harmful characters from user supplied input

Question 21

What does Substitution Input Sanitation do?

Answer 21

Replaces user supplied input with safer alternatives

Question 22

What is Dynamic Code Analysis?

Answer 22

Looking a the program while its running in a debugger

Question 23

What is Verification?

Answer 23

Does the software meet the software requirements?

Question 24

What is Validation?

Answer 24

Does the software solve the problem that it was supposed to solve?

Question 25

What is Certification?

Answer 25

Technical evaluation of the security features

Question 26

What is Accreditation?

Answer 26

Managements acceptable of the product (includes risk acceptance)

Question 27

Name the four types of database models

Answer 27

Hierarchical Distributed Object-oriented Relational

Question 28

Describe a Hierarchical Database model

Answer 28

Stores information in a tree-like manner. Predetermined access paths to data.

Question 29

Describe a Distributed Database model

Answer 29

More than one server over several locations

Question 30

Describe an object orientated database model

Answer 30

Designed for non-text data

Question 31

Describe a Relational Database Model

Answer 31

Tables, Rows and Columns. SQL, Oracle is an example

Question 32

What is a Primary Key?

Answer 32

A unique identifier for each record

Question 33

What is Normalization?

Answer 33

The process of removing duplicates and ensuring that each attribute only describes the primary key.

Question 34

What is Entity Integrity?

Answer 34

States that the primary key field cannot be null

Question 35

What is a foreign key?

Answer 35

When a Primary Key is referenced in another table