CSM Software Security & Risk Management 3

Question 1

In the context of software risk management, what does 'residual risk' refer to?

Accepted Answer

Risk remaining after controls have been applied

Answer

Residual risk is the level of risk that remains after mitigation controls have been implemented.

Question 2

Which authentication method requires users to provide something they know AND something they have?

Accepted Answer

Multi-factor authentication

Answer

Multi-factor authentication combines two or more distinct verification factors (knowledge, possession, or inherence) to validate identity.

Question 3

A software team discovers that a critical third-party library they use has an unpatched zero-day vulnerability. The BEST immediate action is:

Accepted Answer

Disable or replace the affected component while evaluating alternatives

Answer

When a critical zero-day is found in a dependency, disabling or replacing it immediately reduces exposure while a permanent fix is sought.

Question 4

What does the 'integrity' component of the CIA triad ensure in software security?

Accepted Answer

Data remains accurate and unaltered by unauthorized parties

Answer

Integrity ensures that data and systems are accurate and have not been improperly modified by unauthorized users or processes.

Question 5

Which secure coding practice directly reduces the risk of injection attacks such as SQL injection?

Accepted Answer

Using parameterized queries or prepared statements

Answer

Parameterized queries separate SQL code from user-supplied data, preventing attackers from injecting malicious SQL commands.

(CSM) Certified Software Manager Practice Test