CISSP Domain 8

When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

• After the system preliminary design has been developed and the data security categorization has been performed

• the vulnerability analysis has been performed and before the system detailed design begins

• After the system preliminary design has been developed and before the data security categorization begins

• After the business functional analysis and the data security categorization have been performed

Which of the following is the BEST method to prevent malware from being introduced into a production environment?

• Purchase software from a limited list of retailers

• Verify the hash key or certificate key of all updates

• Do not permit programs, patches, or updates from the Internet

• Test all new software in a segregated environment

The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life

Cycle (SDLC)?

• System acquisition and development

• System operations and maintenance

• System initiation

• System implementation

What is the BEST approach to addressing security issues in legacy web applications?

• Debug the security issues

• Migrate to newer, supported applications where possible

• Conduct a security assessment

• Protect the legacy application with a web application firewall

Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?

• Check arguments in function calls

• Test for the security patch level of the environment

• Include logging functions

• Digitally sign each application module

An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requirement is

• organization policy.

• industry best practices.

• industry laws and regulations.

• management feedback.

Which of the following is an advantage of using a high-level programming language?

• It decreases execution times for programs

• It allows programmers to define syntax

• It requires programmer-controlled storage management

• It enforces coding standards

A security evaluation report and an accreditation statement are produced in which of the following phases of the system development life cycle?

• project initiation and planning phase

• system design specification phase

• development & documentation phase

• acceptance phase

The PRIMARY purpose of accreditation is to:

• comply with applicable laws and regulations.

• allow senior management to make an informed decision

• protect an organization’s sensitive data.

• verify that all security controls have been implemented properly and are operating in the correct manner.

What is the appropriate role of the security analyst in the application system development or acquisition project?

• Policeman

• Control Evaluator and Consultant

• Data Owner

• Application User