CSM Software Security & Risk Management 2 — Questions and Answers
Question 1: Which risk treatment option involves accepting the potential consequences of a risk without taking additional action?
- Risk avoidance
- Risk mitigation
- Risk acceptance (Correct answer)
- Risk transfer
Correct answer: Risk acceptance
Risk acceptance means acknowledging a risk and choosing not to act further, often when the cost of mitigation exceeds the potential impact.
Question 2: A software manager wants to ensure that no single employee can both approve and execute a financial transaction in a system. Which security principle does this enforce?
- Least privilege
- Separation of duties (Correct answer)
- Defense in depth
- Need to know
Correct answer: Separation of duties
Separation of duties divides critical tasks among multiple people to prevent fraud or error by any single individual.
Question 3: During a penetration test, testers are given full knowledge of the system architecture and source code. This approach is called:
- Black-box testing
- Gray-box testing
- White-box testing (Correct answer)
- Regression testing
Correct answer: White-box testing
White-box (or clear-box) penetration testing gives testers complete internal knowledge of the system being tested.
Question 4: What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?
- Encrypting data at rest
- Centrally collecting and correlating security logs for threat detection (Correct answer)
- Managing user access credentials
- Scanning code for vulnerabilities
Correct answer: Centrally collecting and correlating security logs for threat detection
A SIEM aggregates and correlates log data from multiple sources to detect security incidents in real time.
Question 5: Which software vulnerability allows an attacker to read memory outside the bounds of an allocated buffer?
- SQL injection
- Buffer overflow (Correct answer)
- Cross-site scripting
- Race condition
Correct answer: Buffer overflow
A buffer overflow occurs when a program writes or reads beyond the memory allocated for a buffer, potentially exposing sensitive data or enabling code execution.
Question 6: A risk register entry shows a vulnerability with LOW likelihood but HIGH impact. How should a software manager prioritize it?
- Ignore it since the likelihood is low
- Monitor it and plan contingency measures (Correct answer)
- Immediately assign maximum resources to eliminate it
- Transfer it without further analysis
Correct answer: Monitor it and plan contingency measures
Low-likelihood, high-impact risks warrant monitoring and contingency planning rather than immediate full-scale mitigation.
Question 7: Which type of malware disguises itself as legitimate software while secretly enabling unauthorized access to a system?
- Ransomware
- Worm
- Trojan horse (Correct answer)
- Spyware
Correct answer: Trojan horse
A Trojan horse appears to be benign or useful software but contains hidden malicious functionality that enables attacker access.
CSM Software Security & Risk Management 2
Which risk treatment option involves accepting the potential consequences of a risk without taking additional action?