CSLLP Secure Software Concepts

Question 1

Which principle states that a system should grant users only the minimum access rights needed to perform their job functions?

Accepted Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Question 2

What does the CIA triad stand for in information security?

Accepted Answer

Confidentiality, Integrity, Availability

Answer

Control, Identity, Authentication

Answer

Compliance, Integrity, Authorization

Answer

Confidentiality, Identity, Assurance

Question 3

Which security concept ensures that a party cannot deny having performed an action or transaction?

Accepted Answer

Non-repudiation

Answer

Authentication

Answer

Authorization

Answer

Accountability

Question 4

A threat model that categorizes threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege is known as:

Accepted Answer

STRIDE

Answer

PASTA

Answer

DREAD

Answer

OCTAVE

Question 5

What is the primary goal of defense in depth?

Accepted Answer

Layer multiple security controls so that failure of one does not compromise the system

Answer

Eliminate all vulnerabilities in software

Answer

Encrypt all data at rest and in transit

Answer

Perform regular penetration testing

Question 6

Which term describes the likelihood that a threat will exploit a vulnerability and the resulting impact?

Accepted Answer

Risk

Answer

Threat

Answer

Vulnerability

Answer

Control