C706 - Secure Software Design questions with answers

C706 - Secure Software Design questions
|\ |\ |\ |\ |\ |\




with answers |\




What is Extreme Programming (XP) method of the Agile SDLC
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


Model? - CORRECT ANSWERS ✔✔Small teams working in the
|\ |\ |\ |\ |\ |\ |\ |\ |\


same room to encourage communication, only required
|\ |\ |\ |\ |\ |\ |\


documentation created. |\




What is Crystal Clear for? - CORRECT ANSWERS ✔✔For noncritical
|\ |\ |\ |\ |\ |\ |\ |\ |\


projects using discretionary money, requiring up to six or eight
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


people. One team same room. Max release 2 months.
|\ |\ |\ |\ |\ |\ |\ |\




What is Crystal Orange for? - CORRECT ANSWERS ✔✔Adequate
|\ |\ |\ |\ |\ |\ |\ |\ |\


for critical, but not life-critical, projects requiring up to 40 people.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


Different teams. From 2 to 4 months, two user viewings per
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


release.


How does a SQL Injection attack work? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


✔✔takes advantage of a vulnerability that appears when a web
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


application fails to properly filter or validate data a user enters
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


on a web page to order a product or communicate with a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


company. An attacker can send a malformed SQL query to the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


underlying database to break into it, plant malicious code or
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


access other systems. |\ |\




Agility & Discipline of XP Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\


✔✔Agility - High, Discipline required - High |\ |\ |\ |\ |\ |\

,Agility & Discipline of Crystal Clear Method? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔Agility - High, Discipline required - Low
|\ |\ |\ |\ |\ |\ |\




Agility & Discipline of Crystal Orange Method? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔Agility - Medium, Discipline required - Medium
|\ |\ |\ |\ |\ |\ |\




Agility & Discipline of Scrum Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\


✔✔Agility - High, Discipline required - High
|\ |\ |\ |\ |\ |\




Agility & Discipline of RUP Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\


✔✔Agility - Low to Medium, Discipline required - High
|\ |\ |\ |\ |\ |\ |\ |\




What are four Scrum events? - CORRECT ANSWERS ✔✔1. Sprint
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


planning meeting. |\




2. Daily Scrum
|\ |\




3. Sprint review
|\ |\




4. Sprint retrospective
|\ |\




What are the four Scrum artifacts? - CORRECT ANSWERS ✔✔1.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


Product backlog |\




2. Sprint backlog
|\ |\




3. Increment
|\




4. Burndown chart
|\ |\




What are the three Scrum roles? - CORRECT ANSWERS ✔✔1.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


Product owner - represents customer
|\ |\ |\ |\

, 2. Development team
|\ |\




3. Scrum master - Coaches team, not project manager
|\ |\ |\ |\ |\ |\ |\ |\




What are the three pillar concepts of Scrum? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔1. Transparency - product visible |\ |\ |\ |\ |\




2. Inspection - of artifact or progress
|\ |\ |\ |\ |\ |\




3. Adaptation - Make corrections when required
|\ |\ |\ |\ |\ |\




What security practitioner role handles deployment? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔Release Manager |\ |\




What security practitioner role handles design? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔Architect |\




What security practitioner role handles coding? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔Developer |\




What security practitioner role handles requirements gathering? -
|\ |\ |\ |\ |\ |\ |\


CORRECT ANSWERS ✔✔Business Analyst/Project Manager
|\ |\ |\ |\ |\




This team is familiar with company infrastructure and software
|\ |\ |\ |\ |\ |\ |\ |\ |\


languages and tries to kill system as developers build it. -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


CORRECT ANSWERS ✔✔Red Team |\ |\ |\




This is a method of program debugging by examining the code
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


but not executing the program. Also called code review. -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


CORRECT ANSWERS ✔✔Static analysis |\ |\ |\