Software Requirement Specification (SRS)
330.2
The output of this phase in the SDLC is the SRS or Software Requirement Specification
document
Building
Defining
Designing
Planning and analysis -
Defining
T/F?
Software security is not security software -
True
T/F?
If you have a system that is compromised on which user data resides, it is ethical to inform
users of the breach in privacy -
True
______monitors public sources of vulnerability information and regularly reports of
vulnerabilities
NSA
CERT/CC
CERT/RSA
RSA -
CERT/CC
The ______ database contains vulnerability information from multiple sources including
CERT/CC
X/DFC
RSA
NVD
CERT/CC -
NVD
T/F?
Software security is the idea of engineering software so that it does not continue to function
correctly under malicious attack, protecting information and information systems from
unauthorized access, use, disclosure, disruption, modification, or destruction -
False
Select all that are possible reasons why calculating the cost of a security breach is
challenging.
* Statistics are sometimes unreliable
* A high number of cybercrimes go unreported or even unnoticed
* Indirect costs are over- or underreported or not factored in by reporting agencies
1|Page
, * The lines are often blurred between traditional crimes and new crimes that "owe their
existence to the Internet" -
All of the above
There are two elements to software security: -
developmental and operational
Is concerned with the properties of source code such as correctness, performance, and
security -
Programmer
Is responsible for integrating new and existing software components to create programs or
systems that satisfy a particular set of customer requirements. -
system integrator
are responsible for managing and securing one or more systems, including installing and
removing software, installing patches, and managing system privileges. -
system administrators
is concerned with properties of security flaws and how to identify them. -
security analyst
is concerned with analyzing vulnerabilities in existing and deployed programs. -
vulnerability analyst
is a set of rules and practices that are normally applied by system and network administrators
to their systems to secure them from threats. -
security policy
T/F?
It is ethical to expose a user to security risks that are known and will not be obvious to the
user, without clearly informing the user of those risks (and preferably, mitigation strategies). -
False
An _________ is a technique that takes advantage of a security vulnerability to violate an
explicit or implicit security policy -
exploit
T/F?
Organizations seeking to minimize the possibility of a breach should adopt a strategy pf
prevention and early security defect removal -
True
_______ is a series of phases that provide a common understanding of the software building
process. -
SDLC
The phases of the SDLC include all except:
Defining
Testing
2|Page
330.2
The output of this phase in the SDLC is the SRS or Software Requirement Specification
document
Building
Defining
Designing
Planning and analysis -
Defining
T/F?
Software security is not security software -
True
T/F?
If you have a system that is compromised on which user data resides, it is ethical to inform
users of the breach in privacy -
True
______monitors public sources of vulnerability information and regularly reports of
vulnerabilities
NSA
CERT/CC
CERT/RSA
RSA -
CERT/CC
The ______ database contains vulnerability information from multiple sources including
CERT/CC
X/DFC
RSA
NVD
CERT/CC -
NVD
T/F?
Software security is the idea of engineering software so that it does not continue to function
correctly under malicious attack, protecting information and information systems from
unauthorized access, use, disclosure, disruption, modification, or destruction -
False
Select all that are possible reasons why calculating the cost of a security breach is
challenging.
* Statistics are sometimes unreliable
* A high number of cybercrimes go unreported or even unnoticed
* Indirect costs are over- or underreported or not factored in by reporting agencies
1|Page
, * The lines are often blurred between traditional crimes and new crimes that "owe their
existence to the Internet" -
All of the above
There are two elements to software security: -
developmental and operational
Is concerned with the properties of source code such as correctness, performance, and
security -
Programmer
Is responsible for integrating new and existing software components to create programs or
systems that satisfy a particular set of customer requirements. -
system integrator
are responsible for managing and securing one or more systems, including installing and
removing software, installing patches, and managing system privileges. -
system administrators
is concerned with properties of security flaws and how to identify them. -
security analyst
is concerned with analyzing vulnerabilities in existing and deployed programs. -
vulnerability analyst
is a set of rules and practices that are normally applied by system and network administrators
to their systems to secure them from threats. -
security policy
T/F?
It is ethical to expose a user to security risks that are known and will not be obvious to the
user, without clearly informing the user of those risks (and preferably, mitigation strategies). -
False
An _________ is a technique that takes advantage of a security vulnerability to violate an
explicit or implicit security policy -
exploit
T/F?
Organizations seeking to minimize the possibility of a breach should adopt a strategy pf
prevention and early security defect removal -
True
_______ is a series of phases that provide a common understanding of the software building
process. -
SDLC
The phases of the SDLC include all except:
Defining
Testing
2|Page
