CSM Software Security & Risk Management 3 — Questions and Answers
Question 1: In the context of software risk management, what does 'residual risk' refer to?
- Risk identified after a security audit
- Risk remaining after controls have been applied (Correct answer)
- Risk transferred to a third party
- Risk discovered during development
Correct answer: Risk remaining after controls have been applied
Residual risk is the level of risk that remains after mitigation controls have been implemented.
Question 2: Which authentication method requires users to provide something they know AND something they have?
- Single-factor authentication
- Multi-factor authentication (Correct answer)
- Biometric authentication
- Certificate-based authentication
Correct answer: Multi-factor authentication
Multi-factor authentication combines two or more distinct verification factors (knowledge, possession, or inherence) to validate identity.
Question 3: A software team discovers that a critical third-party library they use has an unpatched zero-day vulnerability. The BEST immediate action is:
- Continue using the library and wait for an official patch
- Disable or replace the affected component while evaluating alternatives (Correct answer)
- Notify the vendor and take no further action
- Increase logging on systems using the library
Correct answer: Disable or replace the affected component while evaluating alternatives
When a critical zero-day is found in a dependency, disabling or replacing it immediately reduces exposure while a permanent fix is sought.
Question 4: What does the 'integrity' component of the CIA triad ensure in software security?
- Data is accessible to authorized users when needed
- Data remains accurate and unaltered by unauthorized parties (Correct answer)
- Data is protected from unauthorized disclosure
- Data is backed up and recoverable
Correct answer: Data remains accurate and unaltered by unauthorized parties
Integrity ensures that data and systems are accurate and have not been improperly modified by unauthorized users or processes.
Question 5: Which secure coding practice directly reduces the risk of injection attacks such as SQL injection?
- Encrypting all database fields
- Using parameterized queries or prepared statements (Correct answer)
- Logging all database queries
- Restricting database user permissions
Correct answer: Using parameterized queries or prepared statements
Parameterized queries separate SQL code from user-supplied data, preventing attackers from injecting malicious SQL commands.
Question 6: A software manager is assessing vendor risk for a cloud provider. Which document BEST summarizes the provider's security controls and audit results?
- Service Level Agreement (SLA)
- SOC 2 Type II report (Correct answer)
- Privacy policy
- End User License Agreement (EULA)
Correct answer: SOC 2 Type II report
A SOC 2 Type II report provides an independent auditor's assessment of a service provider's security, availability, and confidentiality controls over time.
Question 7: Which risk analysis technique assigns numerical probabilities and financial values to produce a quantitative risk score?
- SWOT analysis
- Delphi technique
- Annualized Loss Expectancy (ALE) calculation (Correct answer)
- Qualitative risk matrix
Correct answer: Annualized Loss Expectancy (ALE) calculation
ALE = Single Loss Expectancy × Annual Rate of Occurrence, providing a dollar-value estimate of expected annual loss from a risk.
CSM Software Security & Risk Management 3
In the context of software risk management, what does 'residual risk' refer to?