Deck 3: Principles of Security and Quality

Question 1

Quality code means writing software for an intended purpose that must work when needed.

Answer 1

True

Question 2

ISO and IEEE have published many resources regarding quality software and the development processes that produce such software.

Answer 2

True

Question 3

The principle of Least Privilege states that you should give users the least amount of privilege required to perform their use case functionality.

Answer 3

True

Question 4

Defense in depth is designed on the principle that a single layer of protection from different vendors or software is sufficient.

Question 5

The principle of maintainability includes the tenet that the application is able to run itself.

Question 6

Complex code is better for the development team.

Question 7

Authentication ensures that the user has the appropriate role and privilege to view data.

Question 8

Readability and Credibility are two types of principles of security and quality.

Question 9

A developer can write useful code that will allow unauthorized users to access the applications assets.

Question 10

Availability refers to the percentage of time a developer is available during scheduled hours of operation.

Question 11

The goal of confidentiality is to ensure that no user other than the owner(s) can see or access the data.

Question 12

Complexity will never be a factor no matter how reusable or understandable the code is.

Question 13

The Information Systems Security Association's (ISSA) main purpose is to promote practices that will ensure the confidentiality, integrity and availability of organizational information resources.

Question 14

Software diversity is the ability to anticipate change in the software so that is becomes flexible and self-maintaining.

Question 15

A design that requires one key to send and receive data is more secure than a design that allows access to the information with two keys.

Question 16

"Fail Securely" is simply what happens when the system goes down.

Question 17

The integrity of the application is defined by the way in which the application accepts, transmits and stores data.

Question 18

The goal of SWEBOK is to define a clear set of boundaries and materials that make up software development from an engineering perspective.

Question 19

No one is more responsible for the quality of the code than the Project Manager.

Question 20

The foundation of software applications and the development processes that produce them are based on common best principles of quality code and secure code.

Question 21

What is attained by keeping the data untouched from point of entry into the application to the point of exit?

A) Confidentiality
B) Availability
C) Integrity
D) Security

Question 22

Building smart code is a great way to advertise your skills as a secure developer.

Question 23

CONSTANTS are values that are changeable within a programming language.

Question 24

Working principles of security and quality in the code is also called what?

A) Software development
B) Best practices
C) C.I.A.
D) Coding

Question 25

What is attained by creating code that can change meaning on demand?

A) Software security
B) Software methodology
C) Software process
D) Software diversity

Question 26

What is attained by keeping unauthorized users from accessing confidential information?

A) Security
B) Integrity
C) Trustworthy
D) Confidentiality

Question 27

What is attained by keeping an application operative when needed?

A) Confidentiality
B) Integrity
C) Availability
D) Trustworthy

Question 28

An asset is a valued resource that the application has to protect.

Question 29

What security principle tells the developer to check every access to every object for authority?

A) Complete mediation
B) Least privilege
C) Keep It Simple
D) Separation of Privilege

Question 30

What is attained when a developer creates code that can be run itself and uses parameters?

A) Understandability
B) Flexibility
C) Maintainability
D) Readability

Question 31

Which principle tells the developer to code multiple layers of types of protection?

A) Fail Securely
B) Defense in Depth
C) Least Privilege
D) Keep It Simple

Question 32

What is attained when variable and method names are meaningful and when they represent the actual value they represent?

A) Understandability
B) Maintainability
C) Readability
D) Flexibility

Question 33

What principle might tell the developer to create one server that creates security keys and another server that stores the keys?

A) Least privilege
B) Secrets are hard to keep
C) Fail securely
D) Separation of privilege

Question 34

If complexity can neither be removed nor automated, it should be what?

A) Localized
B) Reduced
C) Hidden
D) Lessened

Question 35

Secure code does not allow who to access the software's assets?

A) Hackers
B) Attackers
C) Unauthorized users
D) Administrators

Question 36

Which part of the application is most likely to be attacked first?

A) GUI
B) Code
C) Weakest link
D) Database

Question 37

Which principle tells the developer to allow the user access to only what is need for that user's job?

A) Least Privilege
B) Fail Securely
C) Keep It Simple
D) Defense in Depth

Question 38

Methodologies help the overall process by making everyday development activities predictable, continual, and most of all visible.

Question 39

It's possible to have quality without security.

Question 40

What industry standard lists characteristics of quality code?

A) IEEE
B) ISO
C) SWEBOK
D) CBK

Question 41

What is attained by giving the user community training resources, help guides, and user manuals?

A) Readability
B) Usability
C) Maintainability
D) Understandability

Question 42

Why is software quality an art form?

A) Can be applied in different ways
B) Subjective - means different things
C) Various components
D) Developers are creative

Question 43

How can a developer fight back from software attacks?

A) Get tougher
B) Get smarter
C) Build smarter applications
D) Get certified

Question 44

What is attained by creating code that can be easily modified without affecting the application as a whole?

A) Flexibility
B) Understandability
C) Maintainability
D) Usability