ISC2 Certified Secure Software Lifecycle Professional CSSLP Exam Questions

Answer : D

The tools used in DRM to define the level of robustness are as follows:

1.Widely available tools: These tools are easy to use and are available to everyone. For example, screw-drivers and file editors.

2.Specialized tools: These tools require skill and are available at reasonable prices. For example, debuggers, decompilers, and memory

scanners.

3.Professional tools: These tools are expensive, require skill, and are not easily available. For example, logic analyzers, circuit emulators,

and chip disassembly systems.

Answer : A

The take-grant protection model is a formal model used in the field of computer security to establish or disprove the safety of a given

computer system that follows specific rules. It shows that for specific systems the question of safety is decidable in linear time, which is in

general undecidable.

The model represents a system as directed graph, where vertices are either subjects or objects. The edges between them are labeled and

the label indicates the rights that the source of the edge has over the destination. Two rights occur in every instance of the model: take and

grant. They play a special role in the graph rewriting rules describing admissible changes of the graph.

Answer D is incorrect. The access matrix is a straightforward approach that provides access rights to subjects for objects.

Answer C is incorrect. The Bell-LaPadula model deals only with the confidentiality of classified material. It does not address integrity or

availability.

Answer B is incorrect. The integrity model was developed as an analog to the Bell-LaPadula confidentiality model and then became

more sophisticated to address additional integrity requirements.

Answer : A

In the waterfall model, software development can be managed if the developers are limited to go back only one stage to rework. If this

limitation is not imposed mainly on a large project with several team members, then any developer can be working on any phase at any time,

and the required rework might be accomplished several times.

Answer B is incorrect. The spiral model is a software development process combining elements of both design and prototyping-in-

stages, in an effort to combine advantages of top-down and bottom-up concepts. The basic principles of the spiral model are as follows:

The focus is on risk assessment and minimizing project risks by breaking a project into smaller segments and providing more ease-of-

change during the development process, as well as providing the opportunity to evaluate risks and weigh consideration of project

continuation throughout the life cycle.

Each cycle involves a progression through the same sequence of steps, for each portion of the product and for each of its levels of

elaboration, from an overall concept-of-operation document down to the coding of each individual program.

Each trip around the spiral traverses the following four basic quadrants:

Determine objectives, alternatives, and constraints of the iteration.

Evaluate alternatives, and identify and resolve risks.

Develop and verify deliverables from the iteration.

Plan the next iteration.

Begin each cycle with an identification of stakeholders and their win conditions, and end each cycle with review and commitment.

Answer D is incorrect. The Prototyping model is a systems development method (SDM). In this model, a prototype is created, tested,

and then reworked as necessary until an adequate prototype is finally achieved from which the complete system or product can now be

developed.

Answer C is incorrect. Rapid Application Development (RAD) refers to a type of software development methodology that uses minimal

planning in favor of rapid prototyping.

Answer : B, C, D

Following are the various international information security standards:

Risk assessment and treatment: Analysis of the organization's information security risks

Security policy: Management direction

Organization of information security: Governance of information security

Asset management: Inventory and classification of information assets

Human resources security: Security aspects for employees joining, moving, and leaving an organization

Physical and environmental security: Protection of the computer facilities

Communications and operations management: Management of technical security controls in systems and networks

Access control: Restriction of access rights to networks, systems, applications, functions, and data

Information systems acquisition, development and maintenance: Building security into applications

Information security incident management: Anticipating and responding appropriately to information security breaches

Business continuity management: Protecting, maintaining, and recovering business-critical processes and systems

Compliance: Ensuring conformance with information security policies, standards, laws, and regulations

Answer A is incorrect. AU audit and accountability is a U.S. Federal Government information security standard.

Answer : B

ESAPI (Enterprise Security API) is a group of classes that encapsulate the key security operations, needed by most of the applications. It is a

free, open source, Web application security control library. ESAPI provides an easy way to programmers for writing lower-risk applications and

retrofitting security into an existing application. It offers a solid foundation for new development.

Answer A is incorrect. Watermarking is the process of embedding information into software in a way that is difficult to remove.

Answer C is incorrect. Encryption wrapper dynamically encrypts and decrypts all the software code at runtime.

Answer D is incorrect. Code obfuscation is designed to protect code from decompilation.

Answer : D

BCP is a strategy to minimize the consequence of the instability and to allow for the continuation of business processes. The goal of BCP is to

minimize the effects of a disruptive event on a company, and is formed to avoid interruptions to normal business activity.

Business Continuity Planning (BCP) is the creation and validation of a practiced logistical plan for how an organization will recover and restore

partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption. The logistical

plan is called a business continuity plan.

Answer B is incorrect. A contingency plan is a plan devised for a specific situation when things could go wrong. Contingency plans are

often devised by governments or businesses who want to be prepared for anything that could happen. Contingency plans include specific

strategies and actions to deal with specific variances to assumptions resulting in a particular problem, emergency, or state of affairs. They also

include a monitoring process and 'triggers' for initiating planned actions. They are required to help governments, businesses, or individuals to

recover from serious incidents in the minimum time with minimum cost and disruption.

Answer C is incorrect. Disaster recovery planning is a subset of a larger process known as business continuity planning and should

include planning for resumption of applications, data, hardware, communications (such as networking), and other IT infrastructure. A business

continuity plan (BCP) includes planning for non-IT related aspects such as key personnel, facilities, crisis communication, and reputation

protection, and should refer to the disaster recovery plan (DRP) for IT-related infrastructure recovery/continuity.

Answer A is incorrect. The Continuity Of Operation Plan (COOP) refers to the preparations and institutions maintained by the United

States government, providing survival of federal government operations in the case of catastrophic events. It provides procedures and

capabilities to sustain an organization's essential. COOP is the procedure documented to ensure persistent critical operations throughout any

period where normal operations are unattainable.

Answer : A, C, D, E

NIACAP has four levels of certification. These levels ensure that the appropriate C&A are performed for varying schedule and budget

limitations. The certifier must analyze the system's business functions. The certifier determines the degree of confidentiality, integrity,

availability, and accountability, and then recommends one of the following NIACAP certification levels:

Level 1 - Basic Security Review

Level 2 - Minimum Analysis

Level 3 - Detailed Analysis

Level 4 - Comprehensive Analysis

Answer B and F are incorrect. No such types of levels exist.