CSM Software Security & Risk Management 2

Question 1

Which risk treatment option involves accepting the potential consequences of a risk without taking additional action?

Accepted Answer

Risk acceptance

Answer

Risk acceptance means acknowledging a risk and choosing not to act further, often when the cost of mitigation exceeds the potential impact.

Question 2

A software manager wants to ensure that no single employee can both approve and execute a financial transaction in a system. Which security principle does this enforce?

Accepted Answer

Separation of duties

Answer

Separation of duties divides critical tasks among multiple people to prevent fraud or error by any single individual.

Question 3

During a penetration test, testers are given full knowledge of the system architecture and source code. This approach is called:

Accepted Answer

White-box testing

Answer

White-box (or clear-box) penetration testing gives testers complete internal knowledge of the system being tested.

Question 4

What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Centrally collecting and correlating security logs for threat detection

Answer

A SIEM aggregates and correlates log data from multiple sources to detect security incidents in real time.

Question 5

Which software vulnerability allows an attacker to read memory outside the bounds of an allocated buffer?

Accepted Answer

Buffer overflow

Answer

A buffer overflow occurs when a program writes or reads beyond the memory allocated for a buffer, potentially exposing sensitive data or enabling code execution.

(CSM) Certified Software Manager Practice Test

(CSM) Certified Software Manager Practice Test

CSM Software Security & Risk Management 2