CSLLP Secure Software Concepts 3

Question 1

What does the term 'attack surface' refer to in software security?

Accepted Answer

The sum of all entry points where an attacker could try to enter or extract data

Answer

The attack surface is the total exposure of a system, including all interfaces, data paths, and code paths that an attacker could potentially exploit.

Question 2

Which term describes a flaw or weakness in a system that could be exploited to violate security policy?

Accepted Answer

Vulnerability

Answer

A vulnerability is a weakness in a system, application, or process that a threat actor could exploit to gain unauthorized access or cause harm.

Question 3

In the context of CSSLP, what is 'privacy by design'?

Accepted Answer

Embedding privacy protections into the design of systems from the start

Answer

Privacy by design is an approach where privacy protections are integrated into the architecture and design of systems from the very beginning rather than being added retroactively.

Question 4

A security control that detects and alerts on attacks but does not prevent them is called:

Accepted Answer

Detective control

Answer

Detective controls identify and record security incidents or policy violations but do not stop them from occurring, providing visibility for response activities.

Question 5

What is the purpose of a security control baseline in software development?

Accepted Answer

To define the minimum set of security controls required for a given risk level

Answer

A security control baseline establishes the minimum security requirements that must be met based on the system's categorization, providing a starting point for tailoring controls.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Concepts 3