CSSLP Domain 6 - Software Acceptance Complete Solutions

CSSLP Domain 6 - Software Acceptance Complete Solutions Your organization has the policy to attest the security of any software that will be deployed into the production environment. A third party vendor software is being evaluated for its readiness to be deployed. Which of the following verification and validation mechanism can be employed to attest the security of the vendor's software? A. Source code review B. Threat modeling the software C. Black box testing D. Structural analysis C. Black box testing To meet the goals of software assurance, when accepting software, the acquisition phase MUST include processes to A. verify that installation guides and training manuals are provided B. assess the presence and effectiveness of protection mechanisms C. validate vendor's software products D. assist the vendor in responding to the request for proposals b. assess the presence and effectiveness of protection mechanisms The process of evaluating software to determine whether the products of a given development phase satisfies the conditions imposed at the start of the phase is referred to as A. verification B. validation C. authentication D. authorization A. verification When verification activities are used to determine if the software is functioning as it is expected to, it provides insight into which of the following aspects of software assurance? A. Redundancy B. Reliability C. Resiliency D. Recoverability B. Reliability When procuring software the purchasing company can request the evaluation assurance levels (EALs) of the software product which is determined using which of the following evaluation methodologies? A. Operationally Critical Assets Threats and Vulnerability Evaluation (OCTAVE) B. Security Quality Requirements Engineering (SQUARE) C. Common Criteria D. Comprehensive, Lightweight Application Security Process (CLASP) C. Common Criteria The FINAL activity in the software acceptance process is the go/no go decision that can be determined using A. regression testing B. integration testing C. unit testing D. user acceptance testing D. user acceptance testing Management's formal acceptance of the system after an understanding of the residual risks to that system in the computing environment is also referred to as A. patching B. hardening C. certification D. accreditation D. accreditation You determine that a legacy software running in your computing environment is susceptible to Cross Site Request Forgery (CSRF) attacks because of the way it manages sessions. The business has the need to continue use of this software but you do not have the source code available to implement security controls in code as a mitigation measure against CSRF attacks. What is the BEST course of action to undertake in such a situation? A. Avoid the risk by forcing the business to discontinue use of the software B. Accept the risk with a documented exception C. Transfer the risk by buying insurance D. Ignore the risk since it is legacy software B. Accept the risk with a documented exception As part of the accreditation process, the residual risk of a software evaluated for deployment must be