Deck 7: Designing for Security

Question 1

Secure Sockets Layer (SSL) is a crytpographic protocol that uses two keys, known as certificates, to encrypt data in transit to a specific port on the Web server.

Answer 1

True

Question 2

Too much detail in the interaction diagram makes it more difficult to create class diagrams and code.

Answer 2

False

Question 3

Class diagrams are the software requirements specifications for each module in an application.

Answer 3

True

Question 4

It is not the responsibility of the developer to be aware of the costs of designing an application for an organization.

Question 5

A signature contains the following: -The name of the method -The arguments that it takes as input -What the method returns

Question 6

If a person is going to hack into an application, the data objects will be the last thing they target.

Question 7

Code signing can only work with HTTP.

Question 8

Interaction diagrams focus more on how the software objects interact with themselves and other objects.

Question 9

UML diagrams provide a visual representation of the software so that each use case/misuse case can be broken down and analyzed for common secure design patterns and resuable components.

Question 10

Object Modeling does not allow one to visually create the UML models of the software components that are needed to satisfy the use case requirements.

Question 11

By following the standard modeling activities, the developers will have a complete end-to-end understanding of the design of the use case.

Question 12

A firewall is software that most often runs on dedicated hardware that acts as a filter between a private network and a public one.

Question 13

SSL can prevent phishing scams.

Question 14

The firewall's responsibility is to make sure that no traffic gets through.

Question 15

Securing input parameters is the first priority in any application.

Question 16

SSL will guarantee secure data.

Question 17

Assigning the right properties to each class won't eliminate duplicate data in the design but just make each software component more modular.

Question 18

Two-factor authentication makes it difficult for hackers to guess a person's password.

Question 19

Interaction diagrams are the least important artifacts in design.

Question 20

The perimeter defense method divided computers into two camps: "Us" and "them".

Question 21

What is perimeter defense?

A) divide two separate applications between networks to help manage security
B) divide two separate perimeters between networks to help manage security
C) divide two separate firewall between networks to help manage security
D) divide two separate digital certificates between networks to help manage security

Question 22

Validation is done at the point of entry, at the point of origin, or on the fly.

Question 23

The more people who analyze the design for security weaknesses and quality issues, the more chaotic and prone to errors the code becomes.

Question 24

What requires the user's password along with another physical device for authentication?

A) encryption
B) cleint side validation
C) server side validation
D) two-factor authentication

Question 25

What is the first priority in any application?

A) server side validation
B) encrypt data
C) securing input parameters
D) client side validation

Question 26

What design pattern separate the presentation logic from the business logic and is most commonly used in a Web application

A) Abstract Factory
B) MVC
C) Template
D) Factory

Question 27

What secures the machines involved with data transportation that requires the sender to install software on the machine (receiver)?

A) code signing
B) digital certificates
C) SSL
D) Two-Factor authentication

Question 28

What executes code on the fly before sending data to the server?

A) Server side validation
B) MVC
C) Two-Factor authentication
D) Client side validation

Question 29

What Database publishes information on a wide variety of vulnerabilities?

A) US-CERT
B) Oracle
C) IBM DB2
D) ISO

Question 30

What is one way a hacker can steal the software that makes up the application?

A) Unauthorized access to directories
B) steal data packets
C) ARP attacks
D) Denial of Service

Question 31

What are the links called between objects that show what object is being called, who the caller is, what is being communicated, and what is being returned

A) thread
B) messages
C) signatures
D) association

Question 32

What software most often runs on dedicated hardware that acts as a filter between a private network and a public one?

A) Application
B) firewall
C) routers
D) switch

Question 33

What are the software requirements specifications for each module in an application?

A) Object modeling
B) Conceptual model
C) Interaction diagrams
D) Class diagrams

Question 34

Client-side validation happens when the browser executes code very slowly throughout the process.

Question 35

What is a very general term used to describe an authenticated message between two parties

A) SSL certificates
B) Digital certificates
C) Private certificates
D) Public certificates

Question 36

By using frameworks, application developers can spend more time on meeting software requirements rather than dealing with system architecture.

Question 37

What are existing bodies of code that are used to lay the foundation of how your application will be organized and designed?

A) Frameworks
B) Third party code
C) Web services
D) Data access objects

Question 38

What rule is best to follow when assigning properties?

A) the properties of the class should describe the class itself
B) the properties of the class should describe the method on the class
C) the properties of the class should be named appropriately
D) the properties of the class should follow the same design pattern as other classes

Question 39

What are functions on objects that perform specific logic?

A) signatures
B) associations
C) methods
D) properties

Question 40

Server-side validation is the preferred method because server-side languages have more powerful features and are more secure than JavaScript.

Question 41

The firewall's responsibility is to allow certain traffic through based on a?

A) security policy
B) rule
C) encrypt data
D) code signing

Question 42

What focus more on how the software objects interact with themselves and other object?

A) Class Diagrams
B) Conceptual Diagrams
C) Interaction Diagrams
D) Object Models

Question 43

What tells the developer what methods and attributes goes in each class?

A) Class Diagrams
B) Interaction Diagrams
C) Object Modeling
D) Conceptual Models

Question 44

What is a way to visually create the UML models of the software components that are needed to satisfy the use case requirements?

A) white board meetings
B) meeting with analyst
C) Application Guide
D) Object modeling

Question 45

What can be used to secure both the client and the server?

A) HTTPS
B) SSL
C) Code signing
D) Two-Factor authentication