Secure Software Development Exam
Solutions
Course Introduction
Secure Software Development focuses on incorporating security best practices throughout the software development lifecycle. The course delves into identifying common software vulnerabilities, understanding threat modeling, and applying principles such as secure coding, authentication, authorization, and cryptographic techniques. Students will learn to analyze code for security flaws, utilize security testing tools, and integrate security controls in both agile and traditional development environments. By the end of the course, participants will be equipped to design, build, and maintain software systems that are robust against evolving security threats.
Recommended Textbook
Cryptography and Network Security 6th Edition by William Stallings
Available Study Resources on Quizplus
20 Chapters
842 Verified Questions
842 Flashcards
Source URL: https://quizplus.com/study-set/3983
Page 2
Chapter 1: Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80023
Sample Questions
Q1) Irreversible __________ mechanisms include hash algorithms and message authentication codes,which are used in digital signature and message authentication applications.
Answer: encipherment
Q2) Verifying that users are who they say they are and that each input arriving at the system came from a trusted source is _________ .
A)authenticity
B)credibility
C)accountability
D)integrity
Answer: A
Q3) Symmetric encryption is used to conceal the contents of blocks or streams of data of any size,including messages,files,encryption keys,and passwords.
A)True
B)False
Answer: True
Q4) In the United States,the release of student grade information is regulated by the
Answer: Family Educational Rights and Privacy Act (FERPA)
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Classical Encryption Techniques
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80022
Sample Questions
Q1) All encryption algorithms are based on two general principles: substitution and ____________ .
Answer: transposition
Q2) The ___________ takes the ciphertext and the secret key and produces the original plaintext.It is essentially the encryption algorithm run in reverse.
A)Voronoi algorithm
B)decryption algorithm
C)cryptanalysis
D)diagram algorithm
Answer: B
Q3) The task of making large quantities of random keys on a regular basis and distributing a key of equal length to both sender and receiver for every message sent are difficulties of the __________ scheme.
Answer: one-time pad
Q4) The earliest known and simplest use of a substitution cipher was called the __________ cipher and involved replacing each letter of the alphabet with the letter standing three places further down the alphabet.
Answer: Caesar
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Block Ciphers and the Data Encryption Standard
Available Study Resources on Quizplus for this Chatper
27 Verified Questions
27 Flashcards
Source URL: https://quizplus.com/quiz/80021
Sample Questions
Q1) DES exhibits the classic __________ block cipher structure,which consists of a number of identical rounds of processing.
A)Feistel
B)SAC
C)Shannon
D)Rendell
Answer: A
Q2) Confusion seeks to make the statistical relationship between the plaintext and ciphertext as complex as possible in order to thwart attempts to deduce the key.
A)True
B)False
Answer: False
Q3) The Feistel cipher structure,based on Shannon's proposal of 1945, dates back over a quarter of a century and is the structure used by many significant symmetric block ciphers currently in use.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
5
Chapter 4: Basic Concepts in Number Theory and Finite
Fields
Available Study Resources on Quizplus for this Chatper
26 Verified Questions
26 Flashcards
Source URL: https://quizplus.com/quiz/80020
Sample Questions
Q1) Finite fields play a crucial role in several areas of cryptography.
A)True
B)False
Q2) A field is a set in which we can do addition,subtraction, multiplication and division without leaving the set.
A)True
B)False
Q3) The euclidean algorithm cannot be adapted to find the multiplicative inverse of a polynomial.
A)True
B)False
Q4) As a congruence relation,mod expresses that two arguments have the same remainder with respect to a given modulus.
A)True
B)False
Q5) GF stands for __________ field in honor of the mathematician who first studied finite fields.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Q6) Let S be the set of integers,positive,negative,and 0,under the usual operations of addition and multiplication.S is an __________ domain.
Chapter 5: Advanced Encryption Standard
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80019
Sample Questions
Q1) The ordering of bytes within a matrix is by column.
A)True
B)False
Q2) The AES key expansion algorithm takes as input a four-word 16-byte)key and produces a linear array of __________ words 176 bytes).
Q3) The cipher consists of N rounds,where the number of rounds depends on the __________ .
Q4) The _________ transformation operates on each column individually.Each byte of a column is mapped into a new value that is a function of all four bytes in that column.
Q5) A __________ is a set in which you can do addition,subtraction,multiplication and division without leaving the set.
A)record
B)standard
C)field
D)block
Q6) DES is a block cipher intended to replace AES for commercial applications.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Block Cipher Operation
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/80018
Sample Questions
Q1) Five modes of operation have been standardized by NIST for use with symmetric block ciphers such as DES and AES: electronic codebook mode,cipher block chaining mode,cipher feedback mode,__________,and counter mode.
Q2) __________ mode is suitable for parallel operation.Because there is no chaining,multiple blocks can be encrypted or decrypted simultaneously.Unlike CTR mode,this mode includes a nonce as well as a counter.
A)OFB
B)S-AES
C)3DES
D)XTS-AES
Q3) The _________ and _________ block cipher modes of operation are used for authentication.
A)OFB,CTR
B)ECB,CBC
C)CFB,OFB
D)CBC,CFB
Q4) A __________ is a technique for enhancing the effect of a cryptographic algorithm or adapting the algorithm for an application,such as applying a block cipher to a sequence of data blocks or a data stream.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Random and Pseudorandom Number
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80017
Sample Questions
Q1) An algorithm that is used to produce an open-ended sequence of bits is referred to as a ___________ .
Q2) A widely used technique for pseudorandom number generation is an algorithm known as the linear congruential method.
A)True
B)False
Q3) Random numbers play an important role in the use of encryption for various network security applications.
A)True
B)False
Q4) The seed that serves as input to the PRNG must be secure for cryptographic applications.
A)True
B)False
Q5) __________ is a stream cipher designed in 1987 by Ron Rivest for RSA Security.
Q6) Two distinct requirements for a sequence of random numbers are unpredictability and __________ .
Q7) Two criteria used to validate that a sequence of numbers is random are uniform distribution and __________ .
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: More Number Theory
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80016
Sample Questions
Q1) Discrete logarithms are analogous to ordinary logarithms but are defined using modular arithmetic.
A)True
B)False
Q2) With ordinary positive real numbers the logarithm function is the inverse of exponentiation.
A)True
B)False
Q3) All integers have primitive roots.
A)True
B)False
Q4) An important quantity in number theory referred to as __________ ,is defined as the number of positive integers less than n and relatively prime to n.
A)CRT
B)Miller-Rabin
C)Euler's totient function
D)Fermat's theorem
Q5) The _________ of a number is defined to be the power to which some positive base except 1)must be raised in order to equal the number.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Public-Key Cryptography and Rsa
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80015
Sample Questions
Q1) Asymmetric encryption transforms plaintext into ciphertext.
A)True
B)False
Q2) Asymmetric encryption is also known as ___________ .
A)public-key encryption
B)private-key encryption
C)optimal encryption
D)digital-key encryption
Q3) The __________ indicates that the subscriber identified in the certificate has sole control and access to the private key.
A)OAEP
B)Public Key Certificate
C)Digital Signature
D)PKI
Q4) Public-key algorithms are based on __________ .
A)permutation
B)mathematical functions
C)substitution
D)symmetry
Q5) A __________ is when two sides cooperate to exchange a session key.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Other Public-Key Cryptosystems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80014
Sample Questions
Q1) If a secret key is to be used as a _________ for conventional encryption a single number must be generated.
A)discrete logarithm
B)prime curve
C)session key
D)primitive root
Q2) There is not a computational advantage to using ECC with a shorter key length than a comparably secure TSA.
A)True
B)False
Q3) An encryption/decryption system requires a point G and an elliptic group _________ as parameters.
A)Eba,q)
B)Eaq,b)
C)Ena,b)
D)Eqa,b)
Q4) The PRNG variable ___________ is defined in NIST SP 800-90 as a number associated with the amount of work required to break a cryptographic algorithm or system.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Cryptographic Hash Functions
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80013
Sample Questions
Q1) The SHA-512 algorithm has the property that every bit of the hash code is a function of every bit of the input.
A)True
B)False
Q2) The principal object of a hash function is __________ .
A)data integrity
B)compression
C)collision resistance
D)mapping messages
Q3) __________ are measures of the number of potential collisions for a given hash value.
A)MACs
B)Primitives
C)Hash codes
D)Preimages
Q4) Hash functions can be used for intrusion and virus detections.
A)True
B)False
Q5) The hash value of a message in the __________ application is encrypted with a user's private key.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Message Authentication Codes
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80012
Sample Questions
Q1) The __________ mode of operation was standardized by NIST specifically to support the security requirements of IEEE 802.1 WiFi wireless local area networks but can be used in any networking application requiring authenticated encryption.
Q2) The straightforward use of public-key encryption provides confidentiality and authentication.
A)True
B)False
Q3) _________ encryption provides authentication among those who share the secret key.
A)Message
B)Asymmetric
C)Symmetric
D)Authenticated
Q4) The order in which the frame check sequence and encryption functions are performed is not critical for authentication.
A)True
B)False
Q5) HMAC is a widely used standardized _________ function and is implemented in many protocols and applications.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Digital Signatures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80011
Sample Questions
Q1) The _________ is based on the difficulty of computing discrete logarithms and is based on schemes originally presented by ElGamal and Schnorr.
Q2) The attacker finds an efficient signing algorithm that provides an equivalent way of constructing signatures on arbitrary messages is a ___________ .
Q3) With a __________ attack the attacker is allowed to use the user as an "oracle".This means that the user may request signatures of messages that depend on previously obtained message-signature pairs.
A)adaptive chosen message
B)generic chosen
C)directed chosen message
D)known message
Q4) The digital signature standard is a __________ standard that uses the secure hash algorithm.
A)IEEE
B)NIST
C)ISO
D)ITIL
To view all questions and flashcards with answers, click on the resource link above.
Page 15
Chapter 14: Key Management and Distribution
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80010
Sample Questions
Q1) One of the most important uses of a __________ cryptosystem is to encrypt secret keys for distribution.
A)master key
B)KDC
C)public key
D)end-to-end
Q2) A __________ consists of a public key,an identifier of the key owner,and the whole block signed by a trusted third party and can be used by participants to exchange keys without contacting a public key authority in a way that is as reliable as if the keys were obtained directly from a public key authority.
Q3) The more frequently session keys are exchanged the more __________ they are because the opponent has less ciphertext to work with for any given session key.
A)insecure
B)streamlined
C)secure
D)obsolete
Q4) A _________ is a generic term used to denote any method for storing certificates and CRLs so that they can be retrieved by end entities.
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: User Authentication Protocols
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80009
Sample Questions
Q1) It is the ticket that proves the client's identity.
A)True
B)False
Q2) A Kerberos __________ is a set of managed nodes that share the same Kerberos database.
A)realm
B)TGS
C)network
D)principal
Q3) In an unprotected network environment any client can apply to any server for service.The obvious security risk of this is __________ .
A)certification
B)authentication
C)impersonation
D)authorization
Q4) __________ in Greek mythology is a three headed dog with a serpent's tail that guards the entrance of Hades.
Q5) The ticket granting ticket is encrypted with a secret key known only to the AS and the
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: Network Access Control and Cloud Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80008
Sample Questions
Q1) A ________ is a person,organization,or entity responsible for making a service available to interested parties.
A)cloud broker
B)cloud auditor
C)cloud provider
D)cloud carrier
Q2) _________ saves the complexity of software installation,maintenance,upgrades,and patches.
A)IaaS
B)SaaS
C)EAP
D)DHCP
Q3) ___________ is an umbrella term for managing access to a network.
A)NAS
B)ARC
C)NAC
D)RAS
Q4) A __________ provides a form of NAC by allowing or denying network traffic between an enterprise host and an external user.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 17: Transport-Level Security
Available Study Resources on Quizplus for this Chatper
26 Verified Questions
26 Flashcards
Source URL: https://quizplus.com/quiz/80007
Sample Questions
Q1) The Change Cipher Spec Protocol is one of the three SSL-specific protocols that use the SSL Record Protocol.
A)True
B)False
Q2) ISSl/TLS includes protocol mechanisms to enable two TCP users to determine the security mechanisms and services they will use.
A)True
B)False
Q3) The certificate message is required for any agreed on key exchange method except fixed Diffie-Hellman.
A)True
B)False
Q4) __________ provides security services between Transport Layer Protocol and applications that use TCP.
Q5) Unlike traditional publishing environments,the Internet is three- way and vulnerable to attacks on the Web servers.
A)True B)False
Q6) Two important SSL concepts are the SSL session and the SSL _________ .
Page 19
To view all questions and flashcards with answers, click on the resource link above.
Chapter 18: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80006
Sample Questions
Q1) The master session key is also known as the __________ key.
A)AAA
B)GTK
C)MIC
D)STA
Q2) Handheld PDAs pose a security risk in terms of both eavesdropping and spoofing.
A)True
B)False
Q3) A __________ is any device that contains an IEEE 802.11 conformant MAC and physical layer.
A)station
B)MPU
C)service data unit
D)MSDU
Q4) The MPDU exchange for distributing pairwise keys is known as the _________ which the STA and SP use to confirm the existence of the PMK,to verify the selection of the cipher suite,and to derive a fresh PTK for data sessions.
Q5) IEEE 802.11 is a standard for wireless LANs.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Electronic Mail Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/80005
Sample Questions
Q1) The key legitimacy field,the signature trust field and the owner trust field are each contained in a structure referred to as a ___________ .
Q2) The __________ MIME field describes the data contained in the body with sufficient detail that the receiving user agent can pick an appropriate agent or mechanism to represent the data to the user or otherwise deal with the data in an appropriate manner.
Q3) __________ is a security enhancement to the MIME Internet e-mail format standard based on technology from RSA Data Security.
Q4) A _________ is formed by taking the message digest of the content to be signed and then encrypting that with the private key of the signer,which is then encoded using base64 encoding.
Q5) The __________ field is used to identify MIME entities uniquely in multiple contexts.
A)Content-Transfer- Encoding
B)Content-ID
C)Content-Description
D)Content-Type
Q6) ___________ is an open-source,freely available software package for e-mail security.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Ip Security
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/80004
Sample Questions
Q1) Confidentiality is provided by an encryption format known as __________ .
Q2) The selectors that determine a Security Policy Database are: Name,Local and Remote Ports,Next Layer Protocol,Remote IP Address,and _________ .
Q3) The default automated key management protocol for IPsec is referred to as ISAKMP/Oakley.
A)True
B)False
Q4) A _________ is a one way relationship between a sender and a receiver that affords security services to the traffic carried on it.
A)SAD
B)SPD
C)SA
D)SPI
Q5) Transport mode provides protection to the entire IP packet.
A)True
B)False
Q6) Authentication must be applied to the entire original IP packet.
A)True
B)False
Page 22
To view all questions and flashcards with answers, click on the resource link above.