CSLLP Secure Software Concepts 3

Question 1

What does the term 'attack surface' refer to in software security?

Accepted Answer

The sum of all entry points where an attacker could try to enter or extract data

Answer

The visual interface exposed to end users

Answer

The number of known CVEs in a codebase

Answer

The physical perimeter of a data center

Question 2

Which term describes a flaw or weakness in a system that could be exploited to violate security policy?

Accepted Answer

Vulnerability

Answer

Threat

Answer

Risk

Answer

Exposure

Question 3

In the context of CSSLP, what is 'privacy by design'?

Accepted Answer

Embedding privacy protections into the design of systems from the start

Answer

Adding privacy controls as an afterthought after development

Answer

Using obfuscation to hide user data from developers

Answer

Storing all PII in encrypted flat files

Question 4

A security control that detects and alerts on attacks but does not prevent them is called:

Accepted Answer

Detective control

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 5

What is the purpose of a security control baseline in software development?

Accepted Answer

To define the minimum set of security controls required for a given risk level

Answer

To measure code performance against an industry benchmark

Answer

To document all known vulnerabilities in a system

Answer

To compare two versions of source code for changes

Question 6

Which concept describes accepting a risk because the cost of mitigation exceeds the potential loss?

Accepted Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk reduction