CSSLP Domain 4 - Secure Software Implementation/Coding Already Passed

CSSLP Domain 4 - Secure Software Implementation/Coding Already Passed Software developers writes software programs PRIMARILY to A. create new products B. capture market share C. solve business problems D. mitigate hacker threats C. solve business problems The process of combining necessary functions, variable and dependency files and libraries required for the machine to run the program is referred to as A. compilation B. interpretation C. linking D. instatiation C. linking Which of the following is an important consideration to manage memory and mitigate overflow attacks when choosing a programming language? A. Locality of reference B. Type safety C. Cyclomatic complexity D. Parametric polymorphism B. Type safety Assembly and machine language are examples of A. natural language B. very high-level language (VHLL) C. high-level language D. low-level language D. low-level language Using multifactor authentication is effective in mitigating which of the following application security risks? A. Injection flaws B. Cross-site Scripting (XSS) C. Buffer overflow D. Man-in-the-Middle (MITM) D. Man-in-the-Middle (MITM) Impersonation attacks such as Man-in-the-Middle (MITM) attacks in an Internet application can be BEST mitigated using proper A. Configuration Management B. Session Management C. Patch Management D. Exception Management B. Session Management Implementing Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) protection is a means of defending against A. SQL Injection B. Cross-Site Scripting (XSS) C. Cross-Site Request Forgery (CSRF) D. Insecure cryptographic storage C. Cross-Site Request Forgery (CSRF) The findings of a code review indicate that cryptographic operations in code use the Rijndael cipher, which is the original publication of which of the following algorithms? A. Skipjack B. Data Encryption Standard (DES) C. Triple Data Encryption Standard (3DES) D. Advanced Encryption Standard (AES) D. Advanced Encryption Standard (AES) Which of the following transport layer technologies can BEST mitigate session hijacking and replay attacks in a local area network (LAN)? A. Data Loss Prevention (DLP) B. Internet Protocol Security (IPSec) C. Secure Sockets Layer (SSL) D. Digital Rights Management (DRM) C. Secure Sockets Layer (SSL) Verbose error messages and unhandled exception can result in which of the following software security threats? A. Spoofing B. Tampering C. Repudiation D. Information disclosure D. Information disclosure Code signing can provide all of the following EXCEPT A. Anti-tampering protection B. Authenticity of code origin C. Runtime permissions for code D. Authentication of users D. Authentication of users When an attacker uses delayed error messages between successful and unsuccessful query probes, he is using which of the following side channel techniques to detect injection vulnerabilities? A. Distant observation B. Cold boot C. Power analysis D. Timing D. Timing When the code is not allowed to access memory at arbitrary locations that is out of range of the memory address space that belong to the object's publicly exposed fields, it is referred to as which of the following types of codes? A. Object code B. Type safe code C. Obfuscate code D. Source code B. Type safe code When the runtime permissions of the code are defined as security attributes in the metadata of the code, it is referred to as A. imperative syntax security B. declarative syntax security C. code signing D. code obfuscation B. declarative syntax security When an all-or-nothing approach to code access security is not possible and business rules and permissions need to be set and managed more granularly inline code functions and modules, a programmer can leverage which of the following? A. Cryptographic agility B. Parametric polymorphism C. Declarative security D. Imperative security D. imperative security An understanding of which of the following programming concepts is necessary to protect against memory manipulation buffer overflow attacks? Choose the BEST answer. A. Error handling B. Exception management C. Locality of reference D. Generics C. Locality of reference Exploit code attempt to take control of dangling pointers which A. are references to memory locations of destroyed objects B. is the non-functional code that that is left behind in the source C. is the payload code that the attacker uploads into memory to execute D. are references in memory locations that are used prior to being initialized A. are references to memory locations of destroyed objects Which of the following is a feature of most recent operating systems (OS) that makes it difficult for an attacker to guess the memory address of the program as it makes the memory address different each time the program is executed? A. Data Execution Prevention (DEP) B. Executable Space Protection (ESP) C. Address Space Layout Randomization (ASLR) D. Safe Security Exception Handler (SAFESEH) C. Address Space Layout Randomization (ASLR) When the source code is made obscure using special programs in order to make the readability of the code difficult when disclosed, the code is also known as A. object code B. obfuscated code C. encrypted code D. hashed code B. obfuscated code The ability to track ownership, changes in code and rollback abilities is possible because of which of the following configuration management processes? A. Version control B. Patching C. Audit logging D. Change control A. Version control The MAIN benefit of statically analyzing code is that A. runtime behavior of code can be analyzed B. business logic flaws are more easily detectable C. the analysis is performed in a production or production-like environment D. errors and vulnerabilities can be detected earlier in the life cycle D. errors and vulnerabilities can be detected earlier in the life cycle Cryptographic protection includes all of the following EXCEPT A. encryption of data when it is processed B. hashing of data when it is stored C. hiding of data within other media objects when it is transmitted D. masking of data when it is displayed D. masking of data when it is displayed Replacing the Primary Account Number (PAN) with random or pseudo-random symbols that are uniquely identifiable and still assuring privacy is also known as A. Fuzzing B. Tokenization C. Encoding D. Canonicalization B. Tokenization Which of the following is an implementation of the principle of least privilege? A. Sandboxing B. Tokenization C. Versioning D. Concurrency A. Sandboxing