D487: Secure Software Design Questions

D487: Secure Software Design Questions


1. What care cthe ctwo ccommon cbest cprinciples cof csoftware capplications
cin cthe cdevelopment cprocess? cChoose c2 canswers.

Quality c code
cSecure ccode

cInformation

csecurity cIntegrity

Availability: cQuality
ccode cSecure ccode



"Quality ccode" cis ccorrect. cQuality ccode cis cefficient ccode cthat cis ceasy cto
cmaintain cand creusable.

"Secure ccode" cis ccorrect. cSecure ccode cauthorizes cand cauthenticates
cevery cuser ctransaction, clogs cthe ctransaction, cand cdenies call

cunauthorized crequisitions.

2. What censures cthat cthe cuser chas cthe cappropriate crole cand cprivilege cto
cview cdata?

Authentication
Multi-factor
cauthentication

cEncryption

Information csecurity
cAuthorization:

cAuthorization



Authorization censures ca cuser's cinformation cand ccredentials care
capproved cby cthe csystem.

3. Which csecurity cgoal cis cdefined cby c"guarding cagainst cimproper
cinformation cmodification cor cdestruction cand censuring cinformation cnon-

repudiation cand cauthenticity"?
Integrity
cQuality

cAvailabilit


1 c/

,y
Reliability: cIntegrity

The cdata cmust cremain cunchanged cby cunauthorized cusers cand cremain
creliable cfrom cthe cdata centry cpoint cto cthe cdatabase cand cback.

4. Which cphase cin can cSDLC chelps cto cdefine cthe cproblem cand cscope
cof cany cexisting csystems cand cdetermine cthe cobjectives cof cnew

csystems? cRequirements

Design
cPlannin

g
Testing: cPlanning




2 c/

,The cplanning cstage csets cthe cproject cschedule cand clooks cat cthe cbig
cpicture.

5. What chappens cduring ca cdynamic ccode creview?
Programmers cmonitor csystem cmemory, cfunctional cbehavior, cresponse
ctimes, cand coverall cperformance.

Customers cperform ctests cto ccheck csoftware cmeets crequirements.
An canalysis cof ccomputer cprograms cwithout cexecuting cthem cis cperformed.
cInput cfields care csupplied cwith cunexpected cinput cand ctested.: cProgrammers

cmon- citor csystem cmemory, cfunctional cbehavior, cresponse ctimes, cand

coverall cperformance.

6. How cshould cyou cstore cyour capplication cuser ccredentials cin cyour
capplication cdatabase?

Use capplication clogic cto cencrypt
ccredentials cStore ccredentials cas cclear ctext

Store ccredentials cusing cBase c64 cencoded
Store ccredentials cusing csalted chashes: cStore ccredentials cusing csalted
chashes



Hashing cis ca cone-way cprocess cthat cconverts ca cpassword cto
cciphertext cusing chash calgorithms. cPassword csalting cadds crandom

ccharacters cbefore cor cafter ca cpassword cprior cto chashing cto cobfuscate

cthe cactual cpassword.

7. Which csoftware cmethodology cresembles can cassembly-line
capproach? cV-model

Agile cmodel
cIterative

cmodel

Waterfall cmodel: cWaterfall cmodel

Waterfall cmodel cis ca ccontinuous csoftware cdevelopment cmodel cin cwhich
cthe cdevelop- cment csteps cflow csteadily cdownwards.

8. Which csoftware cmethodology capproach cprovides cfaster ctime cto cmarket
cand chigher cbusiness cvalue?

Iterative cmodel
cWaterfall

cmodel cV-

model
Agile cmodel: cAgile cmodel
3 c/

, In cthe cagile cmodel, cprojects care cdivided cinto csmall cincremental
cbuilds cthat cprovide cworking csoftware cat cthe cend cof ceach citeration

cand cadds cvalue cto cbusiness.

9. In cScrum cmethodology, cwho cis cresponsible cfor cmaking cdecisions
con cthe crequirements?

Scrum cTeam




4 c/