Deck 1: Why You Need to Learn Secure Programming

Question 1

Stakeholders are the users of the application.

Answer 1

False

Question 2

UML is a notation that communicates application design, requirements, and process flow.

Answer 2

True

Question 3

ISO sets standards world wide so that one uniform practice exists in a particular industry.

Answer 3

True

Question 4

The developer is the single most important influential person on the development team.

Question 5

Integrity assures the application will be reliable when authorized users need to use the application.

Question 6

Physical attacks occur when software on a machine secretly gathers information about a users activity.

Question 7

Listening to other people's conversation or looking at their computer's monitor are forms of social engineering.

Question 8

A use case describes the security of the application.

Question 9

Most cybercrimes go unnoticed.

Question 10

Social engineering is a complicated attack to learn and carry out.

Question 11

Confidentiality assures that the application maintains complete data privacy.

Question 12

SOX (Sarbanes and Oxley) helps the credit card industry by making sure all electronic transactions are compliant to a security standard.

Question 13

It is possible to develop a completely secure application as long as quality and security are built into the development process.

Question 14

Software requirements document how the system is architected.

Question 15

A single clever dishonest programmer can ruin an entire application's integrity.

Question 16

The primary purpose of the IEEE is to create Web standards.

Question 17

A buffer overflow occurs when attributes of a software object are forced to execute native code due to a flaw in the software's design.

Question 18

Software hackers get paid for performance. Therefore, if your software can not be penetrated in 48 hours or less, the application is pretty safe.

Question 19

Software vulnerabilities are bugs in the software that should have been found during testing.

Question 20

W3C sets standards for Web browsers, JavaScript, and HTML tags.

Question 21

If a person has been developing code for 15 years, then that person should be pretty good at developing code.

Question 22

Every electronic transaction exposes data to an opportunity for an attack.

Question 23

Whose mission is to promote U.S. innovation by applying technology to enhance economic security?

A) NIST
B) IEEE
C) ISO
D) W3C

Question 24

Which of the following standards require participants to build and maintain secure software applications?

A) W3C
B) IEEE
C) PCI
D) SOX

Question 25

Which software artifact best describes the system's behavior under various conditions?

A) Prototype
B) Use case
C) Conceptual model
D) Test case

Question 26

Software artifacts are:

A) Code
B) Documentation
C) Contracts
D) All of the above

Question 27

Record retention includes printing confidential information to printers.

Question 28

Stealing hardware, cutting system cable, or taking application software are examples of what type of attack?

A) Worm
B) Physical
C) Spyware
D) Spoofing

Question 29

Mobile devices are critical to an application's security. Therefore, stringent rules should be followed to ensure they are never lost or damaged.

Question 30

A hidden program that will cause destruction at a given time or event is?

A) Time Bomb
B) Cross-site scripting
C) Phishing
D) Spam

Question 31

What type of attack occurs when an attacker can bypass the application's security mechanism to access the application's resources?

A) SQL Code injection
B) Time bomb
C) Back door
D) Cross site scripting

Question 32

A method involving unauthorized user requests between two parties without either party knowing the communication link has been compromised.

A) Spoofing
B) Social engineering
C) Spam
D) Man in the middle

Question 33

A design flaw in the application that can be exploited to access the application's resources.

A) Vulnerability
B) Bug
C) Error
D) Mistake

Question 34

Which software artifact depicts how the application could incur abuses from the user?

A) Use case
B) Misuse case
C) Conceptual model
D) Software design

Question 35

Creating a Web site that appears to be someone else's Web site in order to obtain financial or other private information is called?

A) Spam
B) Social engineering
C) Phishing
D) Buffer overflow

Question 36

Traceability is when a person can visually associate one use case requirement to design documentation and ultimately the code snippet.

Question 37

A type of attack that embeds JavaScript functions into HTML data elements so that pages can be redirects to other Web sites without the user knowing.

A) Buffer overflows
B) SQL code injection
C) Back door
D) Cross-site scripting

Question 38

Which of the following types of attacks come from social engineering tactics?

A) Organization penetration
B) Back door
C) Cross-site scripting
D) Buffer overflows

Question 39

This software artifact lists what the system must not do.

A) Software requirement
B) Test case
C) Misuse case
D) Secure requirement

Question 40

Which standard specifies that all company financial statements and records are compliant with industry standard accounting rules and regulations?

A) PCI
B) IEEE
C) ISO
D) SOX

Question 41

What is the best defense against attacks to mobile devices?

A) Know what information is on the device
B) Work in a deactivating mechanism
C) Never store sensitive in the device
D) Anticipate the loss

Question 42

Developers will be able to work from remote places by using this technology provided by Citrix.

A) Remote desktop
B) VPN
C) Laptops
D) PDA

Question 43

What is the best way to create defensive code?

A) Develop traps in the software
B) Think like an attacker
C) Clean up the clutter
D) Create UML misuse cases

Question 44

Which of the following journals deal with information security?

A) Information Week
B) Computer World
C) Cross Talk
D) All of the above

Question 45

If a software developer does not know what a software vulnerability is, what is the most important step before writing code?

A) Learn how to write misuse case
B) Educate themselves on software attacks
C) Know the enemy
D) Learn how to code countermeasures