D487: Secure Software Design Questions
1. What care cthe ctwo ccommon cbest cprinciples cof csoftware capplications
cin cthe cdevelopment cprocess? cChoose c2 canswers.
Quality c code
cSecure ccode
cInformation
csecurity cIntegrity
Availability: cQuality
ccode cSecure ccode
"Quality ccode" cis ccorrect. cQuality ccode cis cefficient ccode cthat cis ceasy cto
cmaintain cand creusable.
"Secure ccode" cis ccorrect. cSecure ccode cauthorizes cand cauthenticates
cevery cuser ctransaction, clogs cthe ctransaction, cand cdenies call
cunauthorized crequisitions.
2. What censures cthat cthe cuser chas cthe cappropriate crole cand cprivilege cto
cview cdata?
Authentication
Multi-factor
cauthentication
cEncryption
Information csecurity
cAuthorization:
cAuthorization
Authorization censures ca cuser's cinformation cand ccredentials care
capproved cby cthe csystem.
3. Which csecurity cgoal cis cdefined cby c"guarding cagainst cimproper
cinformation cmodification cor cdestruction cand censuring cinformation cnon-
repudiation cand cauthenticity"?
Integrity
cQuality
cAvailabilit
1 c/
,y
Reliability: cIntegrity
The cdata cmust cremain cunchanged cby cunauthorized cusers cand cremain
creliable cfrom cthe cdata centry cpoint cto cthe cdatabase cand cback.
4. Which cphase cin can cSDLC chelps cto cdefine cthe cproblem cand cscope
cof cany cexisting csystems cand cdetermine cthe cobjectives cof cnew
csystems? cRequirements
Design
cPlannin
g
Testing: cPlanning
2 c/
,The cplanning cstage csets cthe cproject cschedule cand clooks cat cthe cbig
cpicture.
5. What chappens cduring ca cdynamic ccode creview?
Programmers cmonitor csystem cmemory, cfunctional cbehavior, cresponse
ctimes, cand coverall cperformance.
Customers cperform ctests cto ccheck csoftware cmeets crequirements.
An canalysis cof ccomputer cprograms cwithout cexecuting cthem cis cperformed.
cInput cfields care csupplied cwith cunexpected cinput cand ctested.: cProgrammers
cmon- citor csystem cmemory, cfunctional cbehavior, cresponse ctimes, cand
coverall cperformance.
6. How cshould cyou cstore cyour capplication cuser ccredentials cin cyour
capplication cdatabase?
Use capplication clogic cto cencrypt
ccredentials cStore ccredentials cas cclear ctext
Store ccredentials cusing cBase c64 cencoded
Store ccredentials cusing csalted chashes: cStore ccredentials cusing csalted
chashes
Hashing cis ca cone-way cprocess cthat cconverts ca cpassword cto
cciphertext cusing chash calgorithms. cPassword csalting cadds crandom
ccharacters cbefore cor cafter ca cpassword cprior cto chashing cto cobfuscate
cthe cactual cpassword.
7. Which csoftware cmethodology cresembles can cassembly-line
capproach? cV-model
Agile cmodel
cIterative
cmodel
Waterfall cmodel: cWaterfall cmodel
Waterfall cmodel cis ca ccontinuous csoftware cdevelopment cmodel cin cwhich
cthe cdevelop- cment csteps cflow csteadily cdownwards.
8. Which csoftware cmethodology capproach cprovides cfaster ctime cto cmarket
cand chigher cbusiness cvalue?
Iterative cmodel
cWaterfall
cmodel cV-
model
Agile cmodel: cAgile cmodel
3 c/
, In cthe cagile cmodel, cprojects care cdivided cinto csmall cincremental
cbuilds cthat cprovide cworking csoftware cat cthe cend cof ceach citeration
cand cadds cvalue cto cbusiness.
9. In cScrum cmethodology, cwho cis cresponsible cfor cmaking cdecisions
con cthe crequirements?
Scrum cTeam
4 c/
1. What care cthe ctwo ccommon cbest cprinciples cof csoftware capplications
cin cthe cdevelopment cprocess? cChoose c2 canswers.
Quality c code
cSecure ccode
cInformation
csecurity cIntegrity
Availability: cQuality
ccode cSecure ccode
"Quality ccode" cis ccorrect. cQuality ccode cis cefficient ccode cthat cis ceasy cto
cmaintain cand creusable.
"Secure ccode" cis ccorrect. cSecure ccode cauthorizes cand cauthenticates
cevery cuser ctransaction, clogs cthe ctransaction, cand cdenies call
cunauthorized crequisitions.
2. What censures cthat cthe cuser chas cthe cappropriate crole cand cprivilege cto
cview cdata?
Authentication
Multi-factor
cauthentication
cEncryption
Information csecurity
cAuthorization:
cAuthorization
Authorization censures ca cuser's cinformation cand ccredentials care
capproved cby cthe csystem.
3. Which csecurity cgoal cis cdefined cby c"guarding cagainst cimproper
cinformation cmodification cor cdestruction cand censuring cinformation cnon-
repudiation cand cauthenticity"?
Integrity
cQuality
cAvailabilit
1 c/
,y
Reliability: cIntegrity
The cdata cmust cremain cunchanged cby cunauthorized cusers cand cremain
creliable cfrom cthe cdata centry cpoint cto cthe cdatabase cand cback.
4. Which cphase cin can cSDLC chelps cto cdefine cthe cproblem cand cscope
cof cany cexisting csystems cand cdetermine cthe cobjectives cof cnew
csystems? cRequirements
Design
cPlannin
g
Testing: cPlanning
2 c/
,The cplanning cstage csets cthe cproject cschedule cand clooks cat cthe cbig
cpicture.
5. What chappens cduring ca cdynamic ccode creview?
Programmers cmonitor csystem cmemory, cfunctional cbehavior, cresponse
ctimes, cand coverall cperformance.
Customers cperform ctests cto ccheck csoftware cmeets crequirements.
An canalysis cof ccomputer cprograms cwithout cexecuting cthem cis cperformed.
cInput cfields care csupplied cwith cunexpected cinput cand ctested.: cProgrammers
cmon- citor csystem cmemory, cfunctional cbehavior, cresponse ctimes, cand
coverall cperformance.
6. How cshould cyou cstore cyour capplication cuser ccredentials cin cyour
capplication cdatabase?
Use capplication clogic cto cencrypt
ccredentials cStore ccredentials cas cclear ctext
Store ccredentials cusing cBase c64 cencoded
Store ccredentials cusing csalted chashes: cStore ccredentials cusing csalted
chashes
Hashing cis ca cone-way cprocess cthat cconverts ca cpassword cto
cciphertext cusing chash calgorithms. cPassword csalting cadds crandom
ccharacters cbefore cor cafter ca cpassword cprior cto chashing cto cobfuscate
cthe cactual cpassword.
7. Which csoftware cmethodology cresembles can cassembly-line
capproach? cV-model
Agile cmodel
cIterative
cmodel
Waterfall cmodel: cWaterfall cmodel
Waterfall cmodel cis ca ccontinuous csoftware cdevelopment cmodel cin cwhich
cthe cdevelop- cment csteps cflow csteadily cdownwards.
8. Which csoftware cmethodology capproach cprovides cfaster ctime cto cmarket
cand chigher cbusiness cvalue?
Iterative cmodel
cWaterfall
cmodel cV-
model
Agile cmodel: cAgile cmodel
3 c/
, In cthe cagile cmodel, cprojects care cdivided cinto csmall cincremental
cbuilds cthat cprovide cworking csoftware cat cthe cend cof ceach citeration
cand cadds cvalue cto cbusiness.
9. In cScrum cmethodology, cwho cis cresponsible cfor cmaking cdecisions
con cthe crequirements?
Scrum cTeam
4 c/
