Deck 2: Software Engineering and Security

Question 1

14)Before users are allowed to access any information in the MLS model, they assigned a ____ level.

A) lattice
B) classification
C) clearance
D) compartment

Answer 1

C

Question 2

10)A "____" is a special type of "smart" virus that can replicate from system to system without human user intervention.

A) worm
B) Trojan horse
C) macros
D) logic bomb

Answer 2

A

Question 3

17)A ____ case is a specific way of using the system by performing some part of the functionality.

A) positive-use
B) negative-use
C) risk-use
D) designed-use

Answer 3

A

Question 4

16)The ____ model is the most fundamental process model used to build software.

A) XP
B) CLASP
C) AOP
D) waterfall

Question 5

2)The value of a DEUD is the same for every software product deployed.

Question 6

13)____ provides strict access control, allowing information to flow freely between users in a computing system who have appropriate security access while preventing information leaks to unauthorized users.

A) COTS
B) MLS
C) XP
D) CLASP

Question 7

3)Performance and piracy are not considerations when data and execution are sent remotely.

Question 8

6)____ is defined as the illegal copying and/or distributing of copyrighted software without the permission of the copyright holder.

A) Extreme programming
B) Software piracy
C) System protection
D) System leak

Question 9

1)A security requirement is a manifestation of a high-level security policy related to the detailed requirements of a specific system.

Question 10

18)During ____, unified security architecture must be put in place to enable the system to enforce various security principles and fulfill all the use cases from requirement analysis.

A) low-level design
B) high-level design
C) implementation
D) testing

Question 11

12)The term ____ describes products that are commercially available and can be purchased and integrated with little or no customization.

A) TCSEC
B) MLS
C) OTC
D) COTS

Question 12

8)____ breaks the software code into portions that run on ordinary RAM, portions that run on read-only memory (ROM), portions that run under secure hardware, and/or portions that run remotely in a trusted location.

A) Licensing
B) DEUD
C) Hidden licensing
D) Code partitioning

Question 13

20)The ____ model provides an implementation guide that helps project managers to decide if a particular activity needs to be adopted.

A) AOP
B) XP
C) waterfall
D) CLASP

Question 14

19)____ takes a close look at each software module and involves picking the appropriate programming languages, data structures, and algorithms.

A) Low-level design
B) Implementation
C) Testing
D) High-level design

Question 15

5)The MLS security model cannot be implemented on top of another base operating system.

Question 16

9)A ____ attaches itself to a program or data file so that it can spread from one computer to another, infecting as it travels.

A) Trojan
B) cookie
C) virus
D) worm

Question 17

11)A "____" is a type of stand-alone software attack that does not replicate by itself.

A) BIOS virus
B) worm
C) Trojan horse
D) virus

Question 18

7)With ____, the software is stored in such a way that a code is "hidden" before execution and an independently stored key is retrieved and constructed prior to execution using a method known only by the vendor.

A) code protection
B) licensing
C) DEUD protection
D) DEUD

Question 19

4)Security technologies such as firewalls, anti-virus software, and intrusion-detection engines have been developed to "catch" security holes in software systems.

Question 20

15)____ channels allow information to be transmitted by mechanisms not intended for signaling information, for example, locks, system load, or CPU cycle load.

A) Timing
B) Covert
C) Workload
D) Storage

Question 21

28)The _____ is specific information stored in the license that represents the uniqueness between a particular license and the environment where the software product is deployed.

Question 22

34)Why does security depend on more than technologies?

Question 23

29)_____ attack is the practice of conning people into revealing sensitive data about a computer system.

Question 24

25)In AOP, a(n) ____ is a rule indicating a logical description of a set of join points.

A) aspect
B) pointcut
C) advice
D) joint

Question 25

35)Why are security infrastructure mismatches one of the most serious issues in software security?

Question 26

39)What are the two procedures that should be completed before sign-off of the implementation phase of the waterfall model?

Question 27

33)What are some issues that can be prevented by software security?

Question 28

23)____ is a popular AOP language based on Java.

A) JBlue
B) JavaAOP
C) AspectJ
D) SmallTalk

Question 29

31)TCSEC defined _____ as the combination of the computer hardware, the software security kernel, and its privileged components.

Question 30

36)What are the MLS general access rules?

Question 31

27)In terms of software engineering, _____ is defined as the effort to create software in a secure computing platform.

Question 32

22)____ is a new programming paradigm that promotes separation of concerns.

A) AOP
B) XP
C) CLASP
D) Waterfall

Question 33

41)Compare dynamic versus static analysis.

Question 34

40)Briefly describe the main characteristics of the rational unified process (RUP)?

Question 35

26)AOP defines the concept of a(n) ____ as a well-defined point in the program flow.

A) pointcut
B) advice
C) join point
D) aspect

Question 36

What are the three essential TCB elements required to ensure that an MLS system operates correctly?

Question 37

24)AOP introduces a new construct, called a(n) ____, that seeks to encapsulate crosscutting concerns.

A) compartment
B) block
C) clearance
D) aspect

Question 38

21)____ is by far the most talked about and widely used agile methodology, at least among software consulting professionals.

A) Waterfall model
B) CLASP
C) Extreme programming (XP)
D) AOP

Question 39

30)The interrelationships among security levels in the Bell-LaPadula security model form a directed graph called a(n) _____.

Question 40

37)What are the evaluation levels defined by the TCSEC?

Question 42

42)What are the security aspects of AOP?