Secure Software Design C706 WGU – Questions With
Suitable Solutions
Trustworthy Computing Security Development Lifecycle (well-known SDL)
Accurate Answer:- a process that Microsoft has adopted for the
development of software that needs to withstand malicious attack.
The OWASP Software Assurance Maturity Model (SAMM) Accurate
Answer:- is a flexible and prescriptive framework for building security into
a software development organization. Covering more than typical SDLC-based
models for security, SAMM enables organizations to self-assess their security
assurance program and then use recommended roadmaps to improve in a
way that is aligned to the specific risks facing the organization. Beyond that,
SAMM enables creation of scorecards for an organization's effectiveness at
secure software development throughout the typical governance,
development, and deployment business functions. Scorecards also enable
management within an organization to demonstrate quantitative
improvements through iterations of building a security assurance program.
Building Security In Maturity Model (BSIMM) Accurate Answer:- s short
for Building Security In Maturity Model. is a study of real-world software
security initiatives organized so that you can determine where you stand with
your software security initiative and how to evolve your efforts over time. It is
a set of best practices that Cigital developed by analyzing real-world data from
nine leading software security initiatives and creating a framework based on
common areas of success.
ISO/IEC 27034 standard Accurate Answer:- provides guidance to help
organizations embed security within their processes, including application
lifecycle processes, that help to secure applications running in the
environment. It is a risk-based framework to continuously improve security
through process integration and improvements in managing applications. It
takes a process approach by design.
Software Assurance Forum for Excellence in Code (SAFECode) Accurate
Answer:- is a global, industry-led effort to identify and promote best
practices for developing and delivering more secure and reliable software,
hardware, and services.
,SAMATE (Software Assurance Metrics And Tool Evaluation) Accurate
Answer:- project is dedicated to improving software assurance by
developing methods to enable software tool evaluations, measuring the
effectiveness of tools and techniques, and identifying gaps in tools and
methods.
MITRE Corporation Common Computer Vulnerabilities and Exposures (CVE)
Accurate Answer:- is a list of information security vulnerabilities and
exposures that aims to provide common names for publicly-known problems.
This makes it easier to share data across separate vulnerability capabilities
with a common enumeration.
Fuzz testing or fuzzing Accurate Answer:- is a black-box software
testing technique which can be automated or semi-automated, which provides
invalid, unexpected, or random data to the inputs of a computer software
program. In other words, it finds implementation bugs or security flaws by
using malformed/semi-malformed data injection in an automated fashion.
Static program analysis also known as static application security testing
(SAST) Accurate Answer:- is the analysis of computer software that is
performed without actually executing programs. It is predominantly used to
perform analysis on a version of the source code; however, this kind of
analysis may also be done on some form of the object code.
performed by an automated software tool
Dynamic analysis, also known as dynamic application security testing (DAST)
Accurate Answer:- is the analysis of computer software that is performed by
executing programs on a real or virtual processor in real time. The objective is
to find security errors in a program while it is running, rather than by
repeatedly examining the code offline.
is based on system execution (binary code), often using instrumentation. The
advantages of dynamic analysis are that it:
has the ability to detect dependencies that are not detectable using static
analysis—for example, dynamic dependencies using reflection dependency
injection, etc.
,allows the collection of temporal information.
allows the possibility of dealing with runtime values.
allows the identification of vulnerabilities in a runtime environment.
allows the use of automated tools to provide flexibility on what to scan for.
allows the analysis of applications for which you do not have access to the
actual code.
allows identifying vulnerabilities that might be false negatives in the static
code analysis.
permits validating static code analysis findings.
can be conducted on any application.
Software Security Architect Accurate Answer:- is responsible for
providing architectural and technical guidance to product security across all
of Company X. The Architect will design, plan, and implement secure coding
practices and security testing methodology; ensure that practices meet
software certification processes; drive the security testing of the products;
test and evaluate security-related tools; and manage third-party vendors to
meet those responsibilities above.
CIA Triad Accurate Answer:- Confidentiality: Authorized users only: EX.
Un/Pw
Integrity: Prevent changes: EX. editing database
Availability: Equipment available for use: ex. reboots, server failures
Preventive Access Control Accurate Answer:- attempts to thwart or
stop unwanted or unauthorized activity from occurring.
Examples of preventive access controls include fences, locks, biometrics,
mantraps, lighting, alarm systems, separation-of-duties policies, job rotation
policies, data classification, penetration testing, access control methods,
encryption, auditing, the presence of security cameras or closed-circuit
, television (CCTV), smartcards, callback procedures, security policies, security
awareness training, antivirus software, firewalls, and intrusion prevention
systems.
Detective Access Control Accurate Answer:- attempts to discover or
detect unwanted or unauthorized activity. Detective controls operate after the
fact and can discover the activity only after it has occurred.
Examples of detective access controls include security guards, motion
detectors, recording and reviewing of events captured by security cameras or
CCTV, job rotation policies, mandatory vacation policies, audit trails,
honeypots or honeynets, intrusion detection systems, violation reports,
supervision and reviews of users, and incident investigations.
Corrective Access Control Accurate Answer:- modifies the environment
to return systems to normal after an unwanted or unauthorized activity has
occurred. Corrective controls attempt to correct any problems that occurred
because of a security incident.
Corrective controls can be simple, such as terminating malicious activity or
rebooting a system. They also include antivirus solutions that can remove or
quarantine a virus, backup and restore plans to ensure that lost data can be
restored, and active intrusion detection systems that can modify the
environment to stop an attack in progress.
Deterrent Access Control Accurate Answer:- attempts to discourage
security policy violations. Deterrent and preventive controls are similar, but
deterrent controls often depend on individuals deciding not to take an
unwanted action. In contrast, a preventive control blocks the action. Some
examples include policies, security awareness training, locks, fences, security
badges, guards, mantraps, and security cameras.
Recovery Access Control Accurate Answer:- attempts to repair or
restore resources, functions, and capabilities after a security policy violation.
Recovery controls are an extension of corrective controls but have more
advanced or complex abilities. Examples of recovery access controls include
backups and restores, fault-tolerant drive systems, system imaging, server
clustering, antivirus software, and database or virtual machine shadowing.
Suitable Solutions
Trustworthy Computing Security Development Lifecycle (well-known SDL)
Accurate Answer:- a process that Microsoft has adopted for the
development of software that needs to withstand malicious attack.
The OWASP Software Assurance Maturity Model (SAMM) Accurate
Answer:- is a flexible and prescriptive framework for building security into
a software development organization. Covering more than typical SDLC-based
models for security, SAMM enables organizations to self-assess their security
assurance program and then use recommended roadmaps to improve in a
way that is aligned to the specific risks facing the organization. Beyond that,
SAMM enables creation of scorecards for an organization's effectiveness at
secure software development throughout the typical governance,
development, and deployment business functions. Scorecards also enable
management within an organization to demonstrate quantitative
improvements through iterations of building a security assurance program.
Building Security In Maturity Model (BSIMM) Accurate Answer:- s short
for Building Security In Maturity Model. is a study of real-world software
security initiatives organized so that you can determine where you stand with
your software security initiative and how to evolve your efforts over time. It is
a set of best practices that Cigital developed by analyzing real-world data from
nine leading software security initiatives and creating a framework based on
common areas of success.
ISO/IEC 27034 standard Accurate Answer:- provides guidance to help
organizations embed security within their processes, including application
lifecycle processes, that help to secure applications running in the
environment. It is a risk-based framework to continuously improve security
through process integration and improvements in managing applications. It
takes a process approach by design.
Software Assurance Forum for Excellence in Code (SAFECode) Accurate
Answer:- is a global, industry-led effort to identify and promote best
practices for developing and delivering more secure and reliable software,
hardware, and services.
,SAMATE (Software Assurance Metrics And Tool Evaluation) Accurate
Answer:- project is dedicated to improving software assurance by
developing methods to enable software tool evaluations, measuring the
effectiveness of tools and techniques, and identifying gaps in tools and
methods.
MITRE Corporation Common Computer Vulnerabilities and Exposures (CVE)
Accurate Answer:- is a list of information security vulnerabilities and
exposures that aims to provide common names for publicly-known problems.
This makes it easier to share data across separate vulnerability capabilities
with a common enumeration.
Fuzz testing or fuzzing Accurate Answer:- is a black-box software
testing technique which can be automated or semi-automated, which provides
invalid, unexpected, or random data to the inputs of a computer software
program. In other words, it finds implementation bugs or security flaws by
using malformed/semi-malformed data injection in an automated fashion.
Static program analysis also known as static application security testing
(SAST) Accurate Answer:- is the analysis of computer software that is
performed without actually executing programs. It is predominantly used to
perform analysis on a version of the source code; however, this kind of
analysis may also be done on some form of the object code.
performed by an automated software tool
Dynamic analysis, also known as dynamic application security testing (DAST)
Accurate Answer:- is the analysis of computer software that is performed by
executing programs on a real or virtual processor in real time. The objective is
to find security errors in a program while it is running, rather than by
repeatedly examining the code offline.
is based on system execution (binary code), often using instrumentation. The
advantages of dynamic analysis are that it:
has the ability to detect dependencies that are not detectable using static
analysis—for example, dynamic dependencies using reflection dependency
injection, etc.
,allows the collection of temporal information.
allows the possibility of dealing with runtime values.
allows the identification of vulnerabilities in a runtime environment.
allows the use of automated tools to provide flexibility on what to scan for.
allows the analysis of applications for which you do not have access to the
actual code.
allows identifying vulnerabilities that might be false negatives in the static
code analysis.
permits validating static code analysis findings.
can be conducted on any application.
Software Security Architect Accurate Answer:- is responsible for
providing architectural and technical guidance to product security across all
of Company X. The Architect will design, plan, and implement secure coding
practices and security testing methodology; ensure that practices meet
software certification processes; drive the security testing of the products;
test and evaluate security-related tools; and manage third-party vendors to
meet those responsibilities above.
CIA Triad Accurate Answer:- Confidentiality: Authorized users only: EX.
Un/Pw
Integrity: Prevent changes: EX. editing database
Availability: Equipment available for use: ex. reboots, server failures
Preventive Access Control Accurate Answer:- attempts to thwart or
stop unwanted or unauthorized activity from occurring.
Examples of preventive access controls include fences, locks, biometrics,
mantraps, lighting, alarm systems, separation-of-duties policies, job rotation
policies, data classification, penetration testing, access control methods,
encryption, auditing, the presence of security cameras or closed-circuit
, television (CCTV), smartcards, callback procedures, security policies, security
awareness training, antivirus software, firewalls, and intrusion prevention
systems.
Detective Access Control Accurate Answer:- attempts to discover or
detect unwanted or unauthorized activity. Detective controls operate after the
fact and can discover the activity only after it has occurred.
Examples of detective access controls include security guards, motion
detectors, recording and reviewing of events captured by security cameras or
CCTV, job rotation policies, mandatory vacation policies, audit trails,
honeypots or honeynets, intrusion detection systems, violation reports,
supervision and reviews of users, and incident investigations.
Corrective Access Control Accurate Answer:- modifies the environment
to return systems to normal after an unwanted or unauthorized activity has
occurred. Corrective controls attempt to correct any problems that occurred
because of a security incident.
Corrective controls can be simple, such as terminating malicious activity or
rebooting a system. They also include antivirus solutions that can remove or
quarantine a virus, backup and restore plans to ensure that lost data can be
restored, and active intrusion detection systems that can modify the
environment to stop an attack in progress.
Deterrent Access Control Accurate Answer:- attempts to discourage
security policy violations. Deterrent and preventive controls are similar, but
deterrent controls often depend on individuals deciding not to take an
unwanted action. In contrast, a preventive control blocks the action. Some
examples include policies, security awareness training, locks, fences, security
badges, guards, mantraps, and security cameras.
Recovery Access Control Accurate Answer:- attempts to repair or
restore resources, functions, and capabilities after a security policy violation.
Recovery controls are an extension of corrective controls but have more
advanced or complex abilities. Examples of recovery access controls include
backups and restores, fault-tolerant drive systems, system imaging, server
clustering, antivirus software, and database or virtual machine shadowing.
