C706 - Secure Software Design questions
|\ |\ |\ |\ |\ |\
with answers |\
What is Extreme Programming (XP) method of the Agile SDLC
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Model? - CORRECT ANSWERS ✔✔Small teams working in the
|\ |\ |\ |\ |\ |\ |\ |\ |\
same room to encourage communication, only required
|\ |\ |\ |\ |\ |\ |\
documentation created. |\
What is Crystal Clear for? - CORRECT ANSWERS ✔✔For noncritical
|\ |\ |\ |\ |\ |\ |\ |\ |\
projects using discretionary money, requiring up to six or eight
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
people. One team same room. Max release 2 months.
|\ |\ |\ |\ |\ |\ |\ |\
What is Crystal Orange for? - CORRECT ANSWERS ✔✔Adequate
|\ |\ |\ |\ |\ |\ |\ |\ |\
for critical, but not life-critical, projects requiring up to 40 people.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Different teams. From 2 to 4 months, two user viewings per
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
release.
How does a SQL Injection attack work? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔takes advantage of a vulnerability that appears when a web
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
application fails to properly filter or validate data a user enters
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
on a web page to order a product or communicate with a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
company. An attacker can send a malformed SQL query to the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
underlying database to break into it, plant malicious code or
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
access other systems. |\ |\
Agility & Discipline of XP Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔Agility - High, Discipline required - High |\ |\ |\ |\ |\ |\
,Agility & Discipline of Crystal Clear Method? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Agility - High, Discipline required - Low
|\ |\ |\ |\ |\ |\ |\
Agility & Discipline of Crystal Orange Method? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Agility - Medium, Discipline required - Medium
|\ |\ |\ |\ |\ |\ |\
Agility & Discipline of Scrum Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔Agility - High, Discipline required - High
|\ |\ |\ |\ |\ |\
Agility & Discipline of RUP Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔Agility - Low to Medium, Discipline required - High
|\ |\ |\ |\ |\ |\ |\ |\
What are four Scrum events? - CORRECT ANSWERS ✔✔1. Sprint
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
planning meeting. |\
2. Daily Scrum
|\ |\
3. Sprint review
|\ |\
4. Sprint retrospective
|\ |\
What are the four Scrum artifacts? - CORRECT ANSWERS ✔✔1.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Product backlog |\
2. Sprint backlog
|\ |\
3. Increment
|\
4. Burndown chart
|\ |\
What are the three Scrum roles? - CORRECT ANSWERS ✔✔1.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Product owner - represents customer
|\ |\ |\ |\
, 2. Development team
|\ |\
3. Scrum master - Coaches team, not project manager
|\ |\ |\ |\ |\ |\ |\ |\
What are the three pillar concepts of Scrum? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔1. Transparency - product visible |\ |\ |\ |\ |\
2. Inspection - of artifact or progress
|\ |\ |\ |\ |\ |\
3. Adaptation - Make corrections when required
|\ |\ |\ |\ |\ |\
What security practitioner role handles deployment? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Release Manager |\ |\
What security practitioner role handles design? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Architect |\
What security practitioner role handles coding? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Developer |\
What security practitioner role handles requirements gathering? -
|\ |\ |\ |\ |\ |\ |\
CORRECT ANSWERS ✔✔Business Analyst/Project Manager
|\ |\ |\ |\ |\
This team is familiar with company infrastructure and software
|\ |\ |\ |\ |\ |\ |\ |\ |\
languages and tries to kill system as developers build it. -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
CORRECT ANSWERS ✔✔Red Team |\ |\ |\
This is a method of program debugging by examining the code
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
but not executing the program. Also called code review. -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
CORRECT ANSWERS ✔✔Static analysis |\ |\ |\
|\ |\ |\ |\ |\ |\
with answers |\
What is Extreme Programming (XP) method of the Agile SDLC
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Model? - CORRECT ANSWERS ✔✔Small teams working in the
|\ |\ |\ |\ |\ |\ |\ |\ |\
same room to encourage communication, only required
|\ |\ |\ |\ |\ |\ |\
documentation created. |\
What is Crystal Clear for? - CORRECT ANSWERS ✔✔For noncritical
|\ |\ |\ |\ |\ |\ |\ |\ |\
projects using discretionary money, requiring up to six or eight
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
people. One team same room. Max release 2 months.
|\ |\ |\ |\ |\ |\ |\ |\
What is Crystal Orange for? - CORRECT ANSWERS ✔✔Adequate
|\ |\ |\ |\ |\ |\ |\ |\ |\
for critical, but not life-critical, projects requiring up to 40 people.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Different teams. From 2 to 4 months, two user viewings per
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
release.
How does a SQL Injection attack work? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔takes advantage of a vulnerability that appears when a web
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
application fails to properly filter or validate data a user enters
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
on a web page to order a product or communicate with a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
company. An attacker can send a malformed SQL query to the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
underlying database to break into it, plant malicious code or
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
access other systems. |\ |\
Agility & Discipline of XP Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔Agility - High, Discipline required - High |\ |\ |\ |\ |\ |\
,Agility & Discipline of Crystal Clear Method? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Agility - High, Discipline required - Low
|\ |\ |\ |\ |\ |\ |\
Agility & Discipline of Crystal Orange Method? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Agility - Medium, Discipline required - Medium
|\ |\ |\ |\ |\ |\ |\
Agility & Discipline of Scrum Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔Agility - High, Discipline required - High
|\ |\ |\ |\ |\ |\
Agility & Discipline of RUP Method? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\
✔✔Agility - Low to Medium, Discipline required - High
|\ |\ |\ |\ |\ |\ |\ |\
What are four Scrum events? - CORRECT ANSWERS ✔✔1. Sprint
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
planning meeting. |\
2. Daily Scrum
|\ |\
3. Sprint review
|\ |\
4. Sprint retrospective
|\ |\
What are the four Scrum artifacts? - CORRECT ANSWERS ✔✔1.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Product backlog |\
2. Sprint backlog
|\ |\
3. Increment
|\
4. Burndown chart
|\ |\
What are the three Scrum roles? - CORRECT ANSWERS ✔✔1.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
Product owner - represents customer
|\ |\ |\ |\
, 2. Development team
|\ |\
3. Scrum master - Coaches team, not project manager
|\ |\ |\ |\ |\ |\ |\ |\
What are the three pillar concepts of Scrum? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔1. Transparency - product visible |\ |\ |\ |\ |\
2. Inspection - of artifact or progress
|\ |\ |\ |\ |\ |\
3. Adaptation - Make corrections when required
|\ |\ |\ |\ |\ |\
What security practitioner role handles deployment? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Release Manager |\ |\
What security practitioner role handles design? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Architect |\
What security practitioner role handles coding? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\
ANSWERS ✔✔Developer |\
What security practitioner role handles requirements gathering? -
|\ |\ |\ |\ |\ |\ |\
CORRECT ANSWERS ✔✔Business Analyst/Project Manager
|\ |\ |\ |\ |\
This team is familiar with company infrastructure and software
|\ |\ |\ |\ |\ |\ |\ |\ |\
languages and tries to kill system as developers build it. -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
CORRECT ANSWERS ✔✔Red Team |\ |\ |\
This is a method of program debugging by examining the code
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\
but not executing the program. Also called code review. -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\
CORRECT ANSWERS ✔✔Static analysis |\ |\ |\
