C706 WGU- Secure Software Design – Questions With
Reliable Solutions
Functional Requirements Accurate Answer:- Describe what an
application must do to serve a business need.
Nonfunctional requirements (NFRs) Accurate Answer:- Address how
well the functional requirements are met; they constrain the functional
requirements to specified operating ranges.
What percent of current business security vulnerabilities are found within
software applications rather than the network boundaries? Accurate
Answer:- 70%
What is the purpose of secure software development? Accurate Answer:-
Reduce the risk of insecure code:
What term describes what has to work right? Accurate Answer:-
Quality
What term describes what has to be secure? Accurate Answer:-
Security
What are the two challenges to fix vulnerabilities? Accurate Answer:-
The cost and most security activities happen post-release
What is software security? Accurate Answer:- The process of building &
designing secure software
What is application security? Accurate Answer:- the process of
protecting the complete & designed secure software
What is the purpose of software security? Accurate Answer:- Building
secure software; designing software to be secure; and educating software
developers, architects, and users about how to build security in.
,What is the purpose of application security? Accurate Answer:-
Protecting software and the systems that software runs in a post facto, only
after development is complete.
What are the three primary goals of the secure software development
process? Accurate Answer:- Confidentiality, integrity, and availability
SDL vs SDLC Accurate Answer:- Security Development Lifecycle: aimed
at developing secure software.
Software Development Lifecycle: aimed at developing quality software.
What are two goals of the SDL? Accurate Answer:- Reduce the number
of security vulnerabilities & privacy problems and reduce the severity of the
vulnerabilities that remain.
Secure code does not mean _________ ___________ Accurate Answer:-
Quality code
What terms describe quality code? Accurate Answer:- Ease of use,
reusable, and maintainable
Under 44 U.S.C., Sec. 3442 Information Security is defined as: Accurate
Answer:- The protection of information and information systems from
unauthorized access, use, disclosure, disruption, modification, or destruction
in order to provide confidentiality, integrity, and availability.
Under 44 U.S.C., Sec. 3442 Confidentiality is defined as: Accurate
Answer:- Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and proprietary
information.
Under 44 U.S.C., Sec. 3442 Integrity is defined as: Accurate Answer:-
Guarding against improper information modification or destruction, and
includes ensuring information non-repudiation and authenticity.
Under 44 U.S.C., Sec. 3442 Availability is defined as: Accurate Answer:-
Ensuring timely and reliable access to and use of information.
, What is threat modeling? Accurate Answer:- The process of
understanding the potential security threats to the system, determine risk,
and establish appropriate mitigations (What? How bad is it? How can it be
fixed?)
At which point in time is it better to identify and manage security risks?
Accurate Answer:- The earlier, the better
Define modeling software: Accurate Answer:- A way to envision the
interactions of the proposed software within its intended environment.
Define attack surface: Accurate Answer:- testing that should cover the
entry points and exit points of an application that may be accessible to an
attacker
What increases the attack surface? Accurate Answer:- Accessibility
What elements of attack surface can be identified with scanning tools?
Accurate Answer:- Port scanning for open ports and Code analysis tools to
locate code that receives input and sends output
What SDL models are available for the development process? Accurate
Answer:- Trustworthy Computing Security Development Lifecycle
Cigital Software Security Touchpoints model
OWASP SDL
CISCO Secure Development Lifecycle (CSDL)
Which SDL model is the most well known and mature? Accurate Answer:-
Trustworthy Computing Security Development Lifecycle
What is the SDL Optimization Model? Accurate Answer:- Designed to
facilitate gradual, consistent, and cost-effective implementation of the SDL by
development organizations outside of Microsoft; enables development
managers and IT policy makers to assess the state of the security in
development.
Reliable Solutions
Functional Requirements Accurate Answer:- Describe what an
application must do to serve a business need.
Nonfunctional requirements (NFRs) Accurate Answer:- Address how
well the functional requirements are met; they constrain the functional
requirements to specified operating ranges.
What percent of current business security vulnerabilities are found within
software applications rather than the network boundaries? Accurate
Answer:- 70%
What is the purpose of secure software development? Accurate Answer:-
Reduce the risk of insecure code:
What term describes what has to work right? Accurate Answer:-
Quality
What term describes what has to be secure? Accurate Answer:-
Security
What are the two challenges to fix vulnerabilities? Accurate Answer:-
The cost and most security activities happen post-release
What is software security? Accurate Answer:- The process of building &
designing secure software
What is application security? Accurate Answer:- the process of
protecting the complete & designed secure software
What is the purpose of software security? Accurate Answer:- Building
secure software; designing software to be secure; and educating software
developers, architects, and users about how to build security in.
,What is the purpose of application security? Accurate Answer:-
Protecting software and the systems that software runs in a post facto, only
after development is complete.
What are the three primary goals of the secure software development
process? Accurate Answer:- Confidentiality, integrity, and availability
SDL vs SDLC Accurate Answer:- Security Development Lifecycle: aimed
at developing secure software.
Software Development Lifecycle: aimed at developing quality software.
What are two goals of the SDL? Accurate Answer:- Reduce the number
of security vulnerabilities & privacy problems and reduce the severity of the
vulnerabilities that remain.
Secure code does not mean _________ ___________ Accurate Answer:-
Quality code
What terms describe quality code? Accurate Answer:- Ease of use,
reusable, and maintainable
Under 44 U.S.C., Sec. 3442 Information Security is defined as: Accurate
Answer:- The protection of information and information systems from
unauthorized access, use, disclosure, disruption, modification, or destruction
in order to provide confidentiality, integrity, and availability.
Under 44 U.S.C., Sec. 3442 Confidentiality is defined as: Accurate
Answer:- Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and proprietary
information.
Under 44 U.S.C., Sec. 3442 Integrity is defined as: Accurate Answer:-
Guarding against improper information modification or destruction, and
includes ensuring information non-repudiation and authenticity.
Under 44 U.S.C., Sec. 3442 Availability is defined as: Accurate Answer:-
Ensuring timely and reliable access to and use of information.
, What is threat modeling? Accurate Answer:- The process of
understanding the potential security threats to the system, determine risk,
and establish appropriate mitigations (What? How bad is it? How can it be
fixed?)
At which point in time is it better to identify and manage security risks?
Accurate Answer:- The earlier, the better
Define modeling software: Accurate Answer:- A way to envision the
interactions of the proposed software within its intended environment.
Define attack surface: Accurate Answer:- testing that should cover the
entry points and exit points of an application that may be accessible to an
attacker
What increases the attack surface? Accurate Answer:- Accessibility
What elements of attack surface can be identified with scanning tools?
Accurate Answer:- Port scanning for open ports and Code analysis tools to
locate code that receives input and sends output
What SDL models are available for the development process? Accurate
Answer:- Trustworthy Computing Security Development Lifecycle
Cigital Software Security Touchpoints model
OWASP SDL
CISCO Secure Development Lifecycle (CSDL)
Which SDL model is the most well known and mature? Accurate Answer:-
Trustworthy Computing Security Development Lifecycle
What is the SDL Optimization Model? Accurate Answer:- Designed to
facilitate gradual, consistent, and cost-effective implementation of the SDL by
development organizations outside of Microsoft; enables development
managers and IT policy makers to assess the state of the security in
development.
