CASP+: Chapter 5(2of3)

An organization is implementing middleware software to facilitate communication between its applications. They prioritize security considerations to ensure secure communication and flexibility in deploying changes. Considering the provided information, which middleware software utilizes logical addresses for communication and enhances flexibility in deploying changes between applications?

• A) Directory Services

• B) Domain Name System (DNS)

• C) Service-Oriented Architecture (SOA)

• D) Enterprise Service Bus (ESB)

Considering the provided information, which type of code review methodology is likely to be emphasized to achieve the goal of encouraging developers to focus on reviewing altered bits of code instead of entire code bases?

• A) Comprehensive Code Review

• B) Incremental Code Review

• C) Dynamic application security testing (DAST)

• D) Static application security testing (SAST)

A software development team is focused on ensuring that code changes do not break previously working features and that security issues like input validation are adequately addressed. They are implementing a testing approach that specifically checks for these scenarios. Considering the provided information, which testing approach checks if code changes break previously working features, especially for security issues like input validation?

• A) Regression Testing

• B) Unit Testing

• C) Integration Testing

Considering the provided information, which of the following objectives BEST represents the focus of SecDevOps when applied to IT infrastructure management?

• A) Ensuring rapid deployment of new features

• B) Reducing operational overhead

• C) Ensuring compliance with industry regulations

• D) Improving collaboration between development and operations teams

A software development team is focused on establishing a robust software development lifecycle that integrates development and operations seamlessly. They aim to implement a structured process encompassing planning, coding, testing, releasing, deploying, operating, and monitoring. Considering the provided information, which of the following practices involves integrating development and operations through a structured process encompassing various stages of software development?

• A) Validating Third-Party Libraries

• B) Defined DevOps Pipeline

• C) Code Signing

• D) Threat Modeling

Considering the provided information, what are the two code review methodologies primarily employed by the SecDevOps team?

• A) Dynamic application security testing (DAST) and Incremental Code Review

• B) Static application security testing (SAST) and Comprehensive Code Review

• C) Incremental Code Review and Static application security testing (SAST)

• D) Dynamic application security testing (DAST) and Static application security testing (SAST)

Considering the provided information, which of the following practices focuses on ensuring the readiness of the infrastructure supporting the application for production deployment?

• A) Continuous Integration (CI)

• B) Continuous Delivery

• C) Continuous Deployment

• D) Continuous Monitoring

• E) Continuous Validation

A software development team is tasked with enhancing the security of their mobile applications. They are exploring security testing techniques specifically tailored for mobile apps to uncover vulnerabilities that could be exploited by attackers. Considering the provided information, which of the following security testing techniques focuses specifically on testing the security of mobile applications, including both native and hybrid apps?

• A) SCA - Software Composition Analysis

• B) MAST - Mobile Application Security Testing

• C) RASP - Runtime Application Self-Protection

• D) DAST - Dynamic Application Security Testing

A company is evaluating security measures for its enterprise applications to protect valuable data and prevent unauthorized access. They understand the importance of implementing security measures tailored to each application's functionalities. Considering the provided information, which enterprise application requires careful configuration and regular updates to prevent attacks like cross-site scripting, especially considering its user-friendly interface for non-technical users?

• A) CRM (Customer Relationship Management)

• B) ERP (Enterprise Resource Planning)

• C) CMDB (Configuration Management Database)

• D) CMS (Content Management System)

Considering the provided information, which development methodology combines incremental and waterfall approaches, adjusting development based on feedback while maintaining an overall structure and emphasizing risk analysis at each step?

• A) Waterfall Model

• B) Spiral Method

• C) Agile Model

• D) SecDevOps