Cissp Domain 8 - Software Development Security (Matt)

Front 1

_____________ is all the tasks that go into a software engineering project from start to finish.

Back 1

SDLC (Software Development Life Cycle)

Front 2

What are the the types of development methods? (6)

Back 2

Waterfall
Agile
Prototyping
Spiral
Clean Room
Extreme Programming

Front 3

In Integrated Product Teams, what are:
- IPPD (Integrated Product and Process Development)
- IPT (Integrated Product Team)
- DevOps

Back 3

- IPPD Keeps track of big picture
- IPT (Multidisciplinary group of people - responsible for defined product/process)
- DevOps (Blending of tasks performed by company's application development/system operations teams)

Front 4

Which software development model has discrete phases of development that each require formal reviews, approval and documentation before moving to the next step? (measure twice, cut once)

Back 4

Waterfall Method (Linear)

Front 5

Which software development model tests concepts and allows rapid development and testing for feedback?

RAD (Rapid Application Dev. - Time limits)

JAD (Joint Analysis Dev. - Working with users)

Back 5

Prototyping

Front 6

Which software development model has multiple cycles that are repeated in iterations and risk is assessed at each one?

Back 6

Spiral

Front 7

Which software development model is based on the Spiral, based on close face-to-face feedback with the customers and is based on storyboarding? Fast delivery.

Back 7

Agile Model (ASAP)

Front 8

What is a programming technique for Agile framework for effective team collaboration on complex software projects?

It incorporates short 2-3 week iterations called ________.

Back 8

Scrum, sprints

Front 9

Which software development model is an Agile framework that is focused on teamwork and getting done quickly, with very little sleep? Based on user stories (daily actions)

Back 9

Extreme Programming

Front 10

Which software development model that trusts the developer to write good code and gets software right the first time?

Back 10

Clean Room

Front 11

What is CASE?

Back 11

Computer Aided Software Engineering - Integrated Development Environment - aids in development of software (quickly) (tools document as you go)

Front 12

In programming, what is the difference between a compiler and an interpreter?

Back 12

compiler: translates a high level machine language

translator: reads line by line - much slower than compiled language.

Front 13

In software development, what does CMMI stand for?

Back 13

Capability Maturity Model Integrated (a standard model) (replaced CMM)

Front 14

What is the primary standard for software developers to be rated for strong (mature) practices?

Back 14

CMMI (Capability Maturity Model Integrated)

Levels 1-5, 5 is best!

Front 15

What is the only CMM developed specifically to address security in addition to maturity?

Back 15

SSE-CMM (Systems Security Engineering - Capability Maturity Model)

Levels 1-5, 5 is best!

Front 16

What is the open source CMM?

Back 16

Software Assurance Maturity Model (SAMM)

*used with OWASP

Front 17

________ is a framework for IT Governance in a software development company. Aids IT management in developing clear policies and applying industry best practices.

Back 17

COBIT

Front 18

Regarding software development, what is ISO 90003?

Back 18

A new standard in the application of ISO 9001

Front 19

What is Unit Testing?

Back 19

Individual modules/packages are compiled

Front 20

What is Integration Testing?

Back 20

Completed system is verified

Front 21

What is regression testing?

Back 21

Specialist evaluation after changes

Front 22

What is software Penetration testing?

Back 22

Can I break it?

Front 23

What is Acceptance Testing?

Back 23

Meet requirements at the end

Front 24

In an ACID test, what does each letter stand for?

Back 24

Atomicity

Consistency

Isolation

Durability

Front 25

Short Java programs that run within a user's browser are called _________.

Back 25

applets

Front 26

What is is a software component that adds a specific feature to an existing computer program (as in a web browser)? When a program supports plug-ins, it enables customization.

Back 26

Plugins

Front 27

What are the CMMs correct order of maturity levels? (level 1 to 5)

Repeatable, managed, initial, optimized, defined

Back 27

1. Initial

2. Repeatable

3. defined

4. managed

5. optimizing

Front 28

What is static vs dynamic testing?

Back 28

Static: review without executing code

dynamic: review while code is running.

Front 29

In Quality Control, Verification deals with ____________ standards, while Validation deals with ______________ standards.

Back 29

Internal, External

Front 30

Using hacker techniques against a system is called Misuse Case Testing? T/F

Back 30

True

Front 31

An ________test is done with antivirus software by introducing a string that all antivirus products recognize as hostile so that testing can be conducted.

Back 31

EICAR

Front 32

The difference between DoS and DDoS?

Back 32

The attacker in DoS is usually from one source. In DDoS, the attack has been spread to many hosts as launch platforms.

DDoS done by Botnet (zombies, or compromised hosts) commanded by a bot-herder

Front 33

What is a smurf attack?

Back 33

ICMP Echo broadcast spoofed to source IP (DoS attack)

Front 34

In Object Oriented programming, define message, method, and behavior?

Back 34

- Message: how objects communicate to operate

- Method: function of actions an object can carry out

- Behavior: results or output of an object upon receipt of a message

Front 35

What is polymorphism?

Back 35

Multiple forms with different outputs

Front 36

What is Polyinstantiation?

Back 36

Many answers for the same security question - (what color are your eyes)

Front 37

Difference between high and low cohesion?

Back 37

high = more connections or easier to talk to each other (simpler/faster tasks can be carried out)

High Good

Front 38

Difference between high and low coupling?

Back 38

high needs more help (more "couplets" to connect will equal more coordination to complete)

Low = Good

Front 39

What is the difference of these attack vectors?

- Web based server side

- Web based client side

- Network based

Back 39

- Web based server side: defacement, cross-scripting, SQL injection

- Web based client side: downloaded scripts

- Network based: physical or logical access

Front 40

In distributed computing, what was created to allow applications to exchange information over the Internet (though it lacks security)?

Back 40

Simple Object Access Protocol (SOAP)

Front 41

In a distributed environment, what is CORBA (Common Object Request Broker)?

Back 41

Allows for interoperability among the vast array of different software platforms, and hardware. (platform independent middleware)

OLE and ActiveX should be wrong. CORBA should be right.

Front 42

What is a Microsoft middleware that allows two programs to talk?

Back 42

Object Linking and Embedding (OLE)

Front 43

Java applets are (good or bad) for our purposes?

Back 43

Good (uses byte code) (not Bite-Me code)

Front 44

Microsoft ________ runs using OLE. It SUX!

Back 44

Active X

Front 45

What is an older method of manipulating data passed into a website? (CGI)

Back 45

Common Gateway Interface (Bad)

Front 46

T/F Javascript and Java are related?

Back 46

False!

But Javascript is still ok (runs in a sandbox).

ActiveX bad!

Front 47

What is a Fraggle attack?

Back 47

Similar to smurf, but uses UDP instead of ICMP

Front 48

An __________ (ANN) is a mathematical or computational model based on the neural structure of the brain.

Back 48

Artificial Neural Network (ANN)

Front 49

What is software escrow?

Back 49

a legal contract with a third party that provides clients with access to a smaller developer's source code in the event of a business failure. (must request prior to development)

Third party

Front 50

What is software assurance?

Back 50

Level of confidence that acquired software is free from vulnerabilities.

Front 51

What are the 7 similar process steps in software development? (NIST's SP 800-64 SDLC Process steps in Bold)

Back 51

1. Project Initiation/Risk Analysis (1)

2. Functional Design Analysis/Planning

3. System Design Specification

4. Software Development (write code) (2)

5. Install/Test Implement (3)

Only in SLC model:

6. Operational Maintenance (4)

7. Disposal (5)

Front 52

In Software as a Service (SaaS) What is the Service-oriented library?

Back 52

ITIL (IT information Library)

Front 53

What is Fuzz Testing or "fuzzing"?

Back 53

Black box software testing technique. Automaticall feeds a program multiple input iterations, constructed to trigger an internal error, like a bug and potentially crash it.

Front 54

SQL command injection is good/bad for web application?

Back 54

Bad

Front 55

XSS (Cross Site Scripting) is good/bad for web application?

Back 55

Bad

Front 56

What is the _aaS if you hire a middle man to do your hacking called?

Back 56

Malware as a Service.

Front 57

1. A virus is _______in a program.

2. A logic bomb is triggered by an ________.

3. A trojan horse is ________ by a user.

4. A Root kit is ________ within an operating system.

Back 57

1. Embedded

2. Event

3. Installed

4. Hidden

Front 58

What are the countermeasures for a DDoS at the LAN perimeter

Back 58

Drop all ICMP packets originating from the Internet at the firewall.