CYSA QUESTIONS AND ANSWERS SURE A+
✔✔After a major patch is released for the web application that he is responsible for,
Sam proceeds to run his web application security scanner against the web application
to verify that it is still secure. What is the term for the process Sam is conducting? -
✔✔regression testing
✔✔Conducting a _____________ verifies that changes have not introduced new issues
to an application. - ✔✔regression test
✔✔How many phrases does the Spiral model cycle through? - ✔✔four
✔✔The _____________ cycles through four phases: requirements gathering, design,
build, and evaluation/risk analysis. - ✔✔Spiral model
✔✔Charles is worried about users conducting SQL injection attacks. Which of the
following solutions will best address his concerns? - ✔✔performing user input validation
✔✔Charles should perform user input validation to strip out any _____________ or
other unwanted input. - ✔✔SQL code
✔✔_____________ management can help prevent session hijacking. - ✔✔Secure
Session
✔✔_____________ may provide useful information for incident investigation. -
✔✔logging
✔✔Susan's team has been writing code for a major project for a year and recently
released their third version of the code. During a post-implementation regression test,
an issue that was originally seen in version 1 reappeared. What type of tool should
Susan implement to help avoid this issue in the future? - ✔✔source control
management
, ✔✔A source control management tool like _____________ can help prevent old code
from being added to current versions of an application. - ✔✔Subversion or Git
✔✔Susan's team has been writing code for a major project for a year and recently
released their third version of the code. During a post-implementation regression test,
an issue that was originally seen in version 1 reappeared. What type of process should
Susan implement to help avoid this issue in the future? - ✔✔pair programming
✔✔Precompiled SQL statements that only require variables to be input are an example
of what type of application security control? - ✔✔parameterized queries
✔✔A parameterized query, sometimes called a _____________, uses a prebuilt SQL
statement to prevent SQL-based attacks. Variables from the application are fed to the
query, rather than building a custom query when the application needs data. -
✔✔prepared statement
✔✔Input validation and encoding data helps to prevent_____________ attacks. -
✔✔cross-site scripting
✔✔What process checks to ensure that functionality meets customer needs? - ✔✔user
acceptance testing (UAT)
✔✔_____________ is the process of testing to ensure that the users of the software are
satisfied with its functionality. - ✔✔User acceptance testing (UAT)
✔✔_____________ validates individual components of the application. - ✔✔unit testing
✔✔_____________ verifies that the application will perform when under high load or
other stress. - ✔✔stress testing
✔✔What Agile process is used to determine whether application development is
occurring at the speed that was expected? - ✔✔velocity tracking
✔✔_____________ calculates the actual speed based on accomplishments versus the
estimated work from the spring planning effort. - ✔✔Velocity tracking
✔✔In Agile development, _____________ is used to limit the time spent on an effort, by
using a previously agreed-upon time that a person or team uses to work on a specific
goal. This limits the time to work on a goal rather than allowing work until completion. At
the end, the completed work is assessed to determine what needs to occur next. -
✔✔timeboxing
✔✔After a major patch is released for the web application that he is responsible for,
Sam proceeds to run his web application security scanner against the web application
to verify that it is still secure. What is the term for the process Sam is conducting? -
✔✔regression testing
✔✔Conducting a _____________ verifies that changes have not introduced new issues
to an application. - ✔✔regression test
✔✔How many phrases does the Spiral model cycle through? - ✔✔four
✔✔The _____________ cycles through four phases: requirements gathering, design,
build, and evaluation/risk analysis. - ✔✔Spiral model
✔✔Charles is worried about users conducting SQL injection attacks. Which of the
following solutions will best address his concerns? - ✔✔performing user input validation
✔✔Charles should perform user input validation to strip out any _____________ or
other unwanted input. - ✔✔SQL code
✔✔_____________ management can help prevent session hijacking. - ✔✔Secure
Session
✔✔_____________ may provide useful information for incident investigation. -
✔✔logging
✔✔Susan's team has been writing code for a major project for a year and recently
released their third version of the code. During a post-implementation regression test,
an issue that was originally seen in version 1 reappeared. What type of tool should
Susan implement to help avoid this issue in the future? - ✔✔source control
management
, ✔✔A source control management tool like _____________ can help prevent old code
from being added to current versions of an application. - ✔✔Subversion or Git
✔✔Susan's team has been writing code for a major project for a year and recently
released their third version of the code. During a post-implementation regression test,
an issue that was originally seen in version 1 reappeared. What type of process should
Susan implement to help avoid this issue in the future? - ✔✔pair programming
✔✔Precompiled SQL statements that only require variables to be input are an example
of what type of application security control? - ✔✔parameterized queries
✔✔A parameterized query, sometimes called a _____________, uses a prebuilt SQL
statement to prevent SQL-based attacks. Variables from the application are fed to the
query, rather than building a custom query when the application needs data. -
✔✔prepared statement
✔✔Input validation and encoding data helps to prevent_____________ attacks. -
✔✔cross-site scripting
✔✔What process checks to ensure that functionality meets customer needs? - ✔✔user
acceptance testing (UAT)
✔✔_____________ is the process of testing to ensure that the users of the software are
satisfied with its functionality. - ✔✔User acceptance testing (UAT)
✔✔_____________ validates individual components of the application. - ✔✔unit testing
✔✔_____________ verifies that the application will perform when under high load or
other stress. - ✔✔stress testing
✔✔What Agile process is used to determine whether application development is
occurring at the speed that was expected? - ✔✔velocity tracking
✔✔_____________ calculates the actual speed based on accomplishments versus the
estimated work from the spring planning effort. - ✔✔Velocity tracking
✔✔In Agile development, _____________ is used to limit the time spent on an effort, by
using a previously agreed-upon time that a person or team uses to work on a specific
goal. This limits the time to work on a goal rather than allowing work until completion. At
the end, the completed work is assessed to determine what needs to occur next. -
✔✔timeboxing
