Secure Software Design Exam Practice Tests
Course Introduction
Secure Software Design focuses on the principles, methodologies, and best practices required to create robust and resilient software systems resistant to security threats. The course covers the integration of security concepts throughout the software development lifecycle, including threat modeling, secure coding techniques, and vulnerability assessment. Emphasis is placed on identifying and mitigating common security flaws, applying frameworks and standards, and understanding the role of security in requirements analysis, architecture, implementation, and testing. By the end of the course, students will be equipped with the skills necessary to design and develop software that proactively addresses security challenges in todays digital landscape.
Recommended Textbook
Computer Security Principles and Practice 3rd Edition by William Stallings
Available Study Resources on Quizplus
24 Chapters
1076 Verified Questions
1076 Flashcards
Source URL: https://quizplus.com/study-set/3981 Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79973
Sample Questions
Q1) An assault on system security that derives from an intelligent act that is a deliberate attempt to evade security services and violate the security policy of a system is a(n)__________.
A)risk
B)attack
C)asset
D)vulnerability
Answer: B
Q2) The OSI security architecture focuses on security attacks,__________,and services.
Answer: mechanisms
Q3) Release of message contents and traffic analysis are two types of _________ attacks.
Answer: passive
Q4) Establishing,maintaining,and implementing plans for emergency response,backup operations,and post disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations is a __________ plan.
Answer: contingency
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79962
Sample Questions
Q1) The simplest approach to multiple block encryption is known as __________ mode,in which plaintext is handled b bits at a time and each block of plaintext is encrypted using the same key.
Answer: electronic codebook (ECB)
Q2) A __________ is to try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
A)mode of operation
B)hash function
C)cryptanalysis
D)brute-force attack
Answer: D
Q3) A __________ is created by using a secure hash function to generate a hash value for a message and then encrypting the hash code with a private key.
A)digital signature
B)keystream
C)one way hash function
D)secret key
Answer: A
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79956
Sample Questions
Q1) Each individual who is to be included in the database of authorized users must first be __________ in the system.
A)verified
B)identified
C)authenticated
D)enrolled
Answer: D
Q2) A host generated random number is often called a __________.
Answer: nonce
Q3) Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the ___________.
A)identification step
B)authentication step
C)verification step
D)corroboration step
Answer: C
Q4) A __________ is an individual to whom a debit card is issued.
Answer: cardholder
To view all questions and flashcards with answers, click on the resource link above.
Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79955
Sample Questions
Q1) A __________ access control scheme is one in which an entity may be granted access rights that permit the entity,by its own volition,to enable another entity to access some resource.
Q2) _________ is the granting of a right or permission to a system entity to access a system resource.
A)Authorization
B)Authentication
C)Control
D)Monitoring
Q3) X.800 defines __________ as the prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner.
Q4) A __________ is a mapping between a user and an activated subset of the set of roles to which the user is assigned.
Q5) A __________ is an entity capable of accessing objects.
A)group
B)object
C)subject
D)owner
Q6) In digital identity systems,a __________ functions as a certification program.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Q7) The basic elements of access control are: subject,__________,and access right.
Chapter 5: Database and Cloud Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79954
Sample Questions
Q1) A ___________ is a person or organization that maintains a business relationship with cloud providers.
A)cloud consumer
B)cloud auditor
C)cloud carrier
D)cloud broker
Q2) A query language provides a uniform interface to the database.
A)True
B)False
Q3) The _________ model provides a predefined environment for the cloud subscriber that is shared with other tenants,typically through tagging data with a subscriber identifier.
Q4) The __________ cloud infrastructure is operated solely for an organization.
Q5) In a relational database rows are referred to as _________.
A)relations
B)attributes
C)views
D)tuples
Q6) A __________ language provides a uniform interface to the database for users and applications.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79953
Sample Questions
Q1) __________ are used to send large volumes of unwanted e-mail.
A)Rootkits
B)Spammer programs
C)Downloaders
D)Auto-rooter
Q2) Packet sniffers are mostly used to retrieve sensitive information like usernames and passwords.
A)True
B)False
Q3) The term "computer virus" is attributed to __________.
A)Herman Hollerith
B)Fred Cohen
C)Charles Babbage
D)Albert Einstein
Q4) Metamorphic code is software that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics.
A)True
B)False
Q5) __________ code refers to programs that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79952
Sample Questions
Q1) Requests and _______ are the two different types of SIP messages.
Q2) Using forged source addresses is known as _________.
A)source address spoofing
B)a three-way address
C)random dropping
D)directed broadcast
Q3) The best defense against broadcast amplification attacks is to block the use of _______ broadcasts.
Q4) ______ relates to the capacity of the network links connecting a server to the wider Internet.
A)Application resource
B)Network bandwidth
C)System payload
D)Directed broadcast
Q5) During a ______ attack,the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system and when the intermediary responds,the response is sent to the target.
Q6) _____ attacks flood the network link to the server with a torrent of malicious packets competing with valid traffic flowing to the server.
Page 9
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79951
Sample Questions
Q1) Snort can perform intrusion prevention but not intrusion detection.
A)True
B)False
Q2) The IDS component responsible for collecting data is the user interface.
A)True
B)False
Q3) ________ are decoy systems that are designed to lure a potential attacker away from critical systems.
Q4) __________ involves an attempt to define a set of rules or attack patterns that can be used to decide if a given behavior is that of an intruder.
A)Profile based detection
B)Signature detection
C)Threshold detection
D)Anomaly detection
Q5) Copying a database containing credit card numbers,viewing sensitive data without authorization,and guessing and cracking passwords are examples of _________ .
Q6) The functional components of an _________ are: data source,sensor,analyzer,administration,manager,and operator.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79950
Sample Questions
Q1) An important aspect of a distributed firewall configuration is security monitoring.
A)True
B)False
Q2) __________ are attacks that attempt to give ordinary users root access.
A)Privilege-escalation exploits
B)Directory transversals
C)File system access
D)Modification of system resources
Q3) The _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter to protect the premises network from Internet-based attacks.
Q4) __________ looks for deviation from standards set forth in RFCs.
A)Statistical anomaly
B)Protocol anomaly
C)Pattern matching
D)Traffic anomaly
Q5) The firewall can protect against attacks that bypass the firewall.
A)True
B)False
11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79972
Sample Questions
Q1) A buffer overflow in Microoft Windows 2000/XP Local Security Authority Subsystem Service was exploited by the _________ .
A)Aleph One
B)Sasser worm
C)Slammer worm
D)none of the above
Q2) "Smashing the Stack for Fun and Profit" was a step by step introduction to exploiting stack-based buffer overflow vulnerabilities that was published in Phrack magazine by
Q3) Data is simply an array of _________ .
Q4) At the basic machine level,all of the data manipulated by machine instructions executed by the computer processor are stored in either the processor's registers or in memory.
A)True
B)False
Q5) __________ defenses aim to detect and abort attacks in existing programs.
Q6) A __________ can occur as a result of a programming error when a process attempts to store data beyond the limits of a fixed-size buffer and consequently overwrites adjacent memory locations.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
43 Verified Questions
43 Flashcards
Source URL: https://quizplus.com/quiz/79971
Sample Questions
Q1) To prevent XSS attacks any user supplied input should be examined and any dangerous code removed or escaped to block its execution.
A)True B)False
Q2) Defensive programming requires a changed mindset to traditional programming practices.
A)True B)False
Q3) There is a problem anticipating and testing for all potential types of non-standard inputs that might be exploited by an attacker to subvert a program.
A)True
B)False
Q4) UNIX related systems provide the chroot system function to limit a program's view of the file system to just one carefully configured section that is known as a ________.
Q5) An ASCII character can be encoded as a 1 to 4 byte sequence using the UTF-8 encoding.
A)True B)False
Q6) Program input data may be broadly classified as textual or ______.
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79970
Sample Questions
Q1) ________ refers to a technology that provides an abstraction of the computing resources that run in a simulated environment.
Q2) _______ systems should validate all patches on test systems before deploying them to production systems.
Q3) Which of the following need to be taken into consideration during the system security planning process?
A)how users are authenticated
B)the categories of users of the system
C)what access the system has to information stored on other hosts
D)all of the above
Q4) The ______ process retains copies of data over extended periods of time in order to meet legal and operational requirements.
A)archive
B)virtualization
C)patching
D)backup
Q5) Unix and Linux systems use a ________ which restricts the server's view of the file system to just a specified portion.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79969
Sample Questions
Q1) One way to secure against Trojan horse attacks is the use of a secure,trusted operating system.
A)True B)False
Q2) The addition of multilevel security to a database system does not increase the complexity of the access control function.
A)True B)False
Q3) An object is said to have a security clearance of a given level. A)True B)False
Q4) The BLP model effectively breaks down when (untrusted)low classified executable data are allowed to be executed by a high clearance (trusted) subject. A)True B)False
Q5) Multilevel security is of interest when there is a requirement to maintain a resource in which multiple levels of data sensitivity are defined. A)True B)False
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79968
Sample Questions
Q1) _________ is a process used to achieve and maintain appropriate levels of confidentiality,integrity,availability,accountability,authenticity,and reliability.
Q2) A major advantage of the informal approach is that the individuals performing the analysis require no additional skills.
A)True
B)False
Q3) IT security management functions include:
A)determining organizational IT security objectives,strategies,and policies
B)detecting and reacting to incidents
C)specifying appropriate safeguards
D)all of the above
Q4) The advantages of the _________ approach are that it doesn't require the expenditure of additional resources in conducting a more formal risk assessment and that the same measures can be replicated over a range of systems.
A)combined
B)informal
C)baseline
D)detailed
Q5) Not proceeding with the activity or system that creates the risk is _________.
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: It Security Controls,plans,and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79967
Sample Questions
Q1) The ________ audit process should be conducted on new IT systems and services once they are implanted;and on existing systems periodically,often as part of a wider,general audit of the organization or whenever changes are made to the organization's security policy.
Q2) The _______ plan documents what needs to be done for each selected control,along with the personnel responsible,and the resources and time frame to be used.
Q3) Operational controls range from simple to complex measures that work together to secure critical and sensitive data,information,and IT systems functions.
A)True
B)False
Q4) A contingency plan for systems critical to a large organization would be _________ than that for a small business.
A)smaller,less detailed
B)larger,less detailed
C)larger,more detailed
D)smaller,more detailed
Q5) A _________ on an organization's IT systems identifies areas needing treatment.
Q6) Incident response is part of the ________ class of security controls.
Page 17
To view all questions and flashcards with answers, click on the resource link above.
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79966
Sample Questions
Q1) To deal with the threat of smoke,the responsible manager should install _______ in every room that contains computer equipment as well as under raised floors and over suspended ceilings.
Q2) An _______ condition occurs when the IS equipment receives less voltage than is required for normal operation.
Q3) Low-intensity devices such as cellular telephones do not interfere with electronic equipment.
A)True
B)False
Q4) Eavesdropping and wiretapping fall into the ________ category.
A)theft
B)vandalism
C)misuse
D)unauthorized physical access
Q5) _______ includes destruction of equipment and data.
A)Misuse
B)Vandalism
C)Theft
D)Unauthorized physical access
Q6) The most essential element of recovery from physical security breaches is ____.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79965
Sample Questions
Q1) ________ is the process of receiving,initial sorting,and prioritizing of information to facilitate its appropriate handling.
A)Incident
B)Triage
C)Constituency
D)Handling
Q2) Complying with regulations and contractual obligations is a benefit of security awareness,training,and education programs.
A)True
B)False
Q3) A(n)_______ is a characteristic of a piece of technology that can be exploited to perpetrate a security incident.
Q4) The four layers of the learning continuum as summarized by NIST SP 800-16 are: security awareness,security basics and literacy,roles and responsibilities relative to IT systems,and the _________ level.
Q5) The principal problems associated with employee behavior are errors and omissions,_______,and actions by disgruntled employees.
To view all questions and flashcards with answers, click on the resource link above.
Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79964
Sample Questions
Q1) RFC 2196 (Site Security Handbook)lists three alternatives for storing audit records: read/write file on a host,write-once/read-many device,and ______.
Q2) The ________ is a module on a centralized system that collects audit trail records from other systems and creates a combined audit trail.
A)audit dispatcher
B)audit analyzer
C)audit trail collector
D)audit provider
Q3) The audit _______ are a permanent store of security-related events on a system.
Q4) ______ is the process of defining normal versus unusual events and patterns.
Q5) Protection of the audit trail involves both integrity and confidentiality. A)True
B)False
Q6) The first order of business in security audit trail design is the selection of data items to capture.
A)True
B)False
Q7) The ______ repository contains the auditing code to be inserted into an application.
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79963
Sample Questions
Q1) _____ strengthens the protection of copyrighted materials in digital format.
A)HIPPA
B)DMCA
C)WIPO
D)DRM
Q2) A ______ is a word,name,symbol,or device that is used in trade with goods to indicate the source of the goods and to distinguish them from the goods of others.
A)copyright
B)patent
C)trademark
D)all of the above
Q3) The invasion of the rights secured by patents,copyrights,and trademarks is
Q4) Land and things permanently attached to the land,such as trees,buildings,and stationary mobile homes are _______.
A)real property
B)cyber property
C)personal property
D)intellectual property
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79961
Sample Questions
Q1) The _________ was issued as a federal information-processing standard and is intended to replace DES and 3DES with an algorithm that is more secure and efficient.
Q2) There are _____ modes of operation defined by NIST that are intended to cover virtually all the possible applications of encryption for which a block cipher could be used.
A)three
B)five
C)seven
D)nine
Q3) One disadvantage of the link encryption approach is that the message must be decrypted each time it enters a frame switch.
A)True
B)False
Q4) The most widely used encryption scheme is based on the _________ adopted in 1977 by the National Bureau of Standards.
A)AES
B)3DES
C)CES
D)DES
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79960
Sample Questions
Q1) A hash function such as SHA-1 was not designed for use as a MAC and cannot be used directly for that purpose because it does not rely on a secret key.
A)True
B)False
Q2) The Diffie-Hellman algorithm depends for its effectiveness on the difficulty of computing discrete logarithms.
A)True
B)False
Q3) The operations performed during a round consist of circular shifts,and primitive Boolean functions based on DSS,MD5,SHA,and RSA.
A)True
B)False
Q4) If speed is a concern,it is fully acceptable to use _________ rather than SHA as the embedded hash function for HMAC.
Q5) The Secure Hash Algorithm (SHA)was developed by the _________ and published as a federal information processing standard (FIPS 180)in 1993.
Q6) Perhaps the most widely used public-key algorithms are _________ and Diffie-Hellman.
To view all questions and flashcards with answers, click on the resource link above. Page 23
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79959
Sample Questions
Q1) _____ defines a number of content formats,which standardize representations for the support of multimedia e-mail.
A)MEM
B)MIME
C)MSC
D)DKIM
Q2) The basic tool that permits widespread use of S/MIME is ________.
A)the domain key
B)the public-key certificate
C)the MIME security payload
D)radix-64
Q3) At its most fundamental level the Internet mail architecture consists of a user world in the form of _________.
A)MHS
B)MSA
C)MUA
D)MDA
Q4) The ________ is housed in the user's computer and is referred to as a client e-mail program or a local network e-mail server.
To view all questions and flashcards with answers, click on the resource link above. Page 24
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79958
Sample Questions
Q1) Because serial numbers are unique within a CA,the serial number is sufficient to identify the certificate.
A)True
B)False
Q2) ________ allows end entities to restore their encryption/decryption key pair from an authorized key backup facility.
Q3) A principal element of an identity management system is _______.
A)workflow automation
B)delegated administration
C)authentication
D)all of the above
Q4) The certification _________ is the issuer of certificates and certificate revocation lists.
Q5) The _________ is an optional bit string field used to identify uniquely the issuing CA in the event the X.500 name has been reused for different entities.
Q6) Kerberos does not support interrealm authentication.
A)True
B)False
Q7) In a generic identity management architecture a ________ is an identity holder.
Page 25
To view all questions and flashcards with answers, click on the resource link above.
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79957
Sample Questions
Q1) In most data-link control protocols,the data-link protocol entity is responsible not only for detecting errors using the CRC,but for recovering from those errors by retransmitting damaged frames.
A)True
B)False
Q2) The function of the ________ layer is to control access to the transmission medium and to provide an orderly and efficient use of that capacity.
A)CRC
B)MPDU
C)MAC
D)MSDU
Q3) A(n)__________ is any entity that has station functionality and provides access to the distribution system via the wireless medium for associated stations.
A)ESS
B)access point
C)distribution system
D)MPDU
Q4) Like TKIP,CCMP provides two services: message integrity and ________.
Q5) The field following the MSDU field is referred to as the ___________.
To view all questions and flashcards with answers, click on the resource link above. Page 26