CSLLP Secure Software Concepts 1

Question 1

Which principle states that a system should grant users only the minimum access rights needed to perform their job functions?

Accepted Answer

Least privilege

Answer

Least privilege limits access rights to the bare minimum required for a user's legitimate purpose, reducing the attack surface.

Question 2

What does the CIA triad stand for in information security?

Accepted Answer

Confidentiality, Integrity, Availability

Answer

The CIA triad represents the three core security objectives: Confidentiality (preventing unauthorized disclosure), Integrity (ensuring data accuracy), and Availability (ensuring reliable access).

Question 3

Which security concept ensures that a party cannot deny having performed an action or transaction?

Accepted Answer

Non-repudiation

Answer

Non-repudiation provides proof of the origin and integrity of data, preventing a party from later denying they sent or received information.

Question 4

A threat model that categorizes threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege is known as:

Accepted Answer

STRIDE

Answer

STRIDE is a threat modeling methodology developed by Microsoft that provides a structured way to identify and classify software threats.

Question 5

What is the primary goal of defense in depth?

Accepted Answer

Layer multiple security controls so that failure of one does not compromise the system

Answer

Defense in depth uses multiple overlapping security controls so that if one layer is bypassed, additional layers still protect the asset.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Concepts 1