Question 1

Which of the following is a component of PKI?

Accepted Answer

A)   Certification authority
B)   Registration authority
C)   Client nodes
D)   All of the above D

Question 2

Which of the following is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted?

Accepted Answer

A)   NIST
B)   GLBA
C)   MITRE
D)   OWASP D

Question 3

Identification of compliance requirements is done during which of the following phases of the SDLC?

Accepted Answer

A)   Initiation
B)   Development/acquisition
C)   Implementation/assessment
D)   Operations/maintenance A

Question 4

Symmetric key cryptography uses which of the following?

Accepted Answer

A)   One public key
B)   One shared key
C)   Two public keys
D)   One public and one private key

Question 5

Which of the following provides confidentiality?

Accepted Answer

A)   Encryption
B)   Decryption
C)   Hashing
D)   Key management

Question 6

Public key cryptography uses which of the following?

Accepted Answer

A)   A shared key
B)   A public key
C)   A private key
D)   Both a public and a private key

Question 7

Which of the following is the most common web application security flaw?

Accepted Answer

A)   Failure to validate output
B)   Failure to validate input
C)   Dynamic data validation
D)   Static data validation

Question 8

Which of the following is used to associate a public key with an identity?

Accepted Answer

A)   Encryption
B)   Digital hash
C)   Digital certificate
D)   Digital signature

Question 9

In which phase of the SDLC are systems and products in place and operating, enhancements and/or modifications to the system are being developed and tested, and hardware and software components are added or replaced?

Accepted Answer

A)   Initiation
B)   Development/acquisition
C)   Operations/maintenance
D)   Implementation/assessment

Question 10

Which of the following is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization?

Accepted Answer

A)   ISO
B)   SAMM
C)   OWASP
D)   SDLC

Question 11

Which of the following provides a standardized process for all phases of any system development or acquisition effort?

Accepted Answer

A)   COTS
B)   SDLC
C)   NIST
D)   CIA

Question 12

Which of the following is a hybrid of a beta and a final release version of a software product?

Accepted Answer

A)   Release candidate
B)   Alpha phase
C)   General availability
D)   Go live

Question 13

Which of the following is one of the most popular symmetric algorithms of recent years?

Accepted Answer

A)   AES
B)   RSA
C)   DES
D)   IPsec

Question 14

Which of the following is not a best practice for cryptographic key management?

Accepted Answer

A)   Keys should be transmitted and stored by secure means.
B)   Keys should be properly destroyed when their lifetime ends.
C)   Keys should be presented in clear text.
D)   Key values should be random, and the full spectrum of the keyspace should be used.

Question 15

Which of the following statements about asymmetric key cryptography is true?

Accepted Answer

A)   Asymmetric key cryptography uses one shared key.
B)   Asymmetric key cryptography is also called private key cryptography.
C)   Asymmetric key cryptography uses two keys called public keys.
D)   Asymmetric key cryptography is also called public key cryptography.

Question 16

Which of the following tasks is part of the disposal phase of the SDLC?

Accepted Answer

A)   Authorization
B)   Conducting risk assessment
C)   Archiving information and sanitization of media
D)   Adding hardware and software

Question 17

Which of the following statements about symmetric key cryptography is not true?

Accepted Answer

A)   Symmetric key cryptography uses one shared key.
B)   Symmetric algorithms can provide confidentiality.
C)   Symmetric algorithms can provide nonrepudiation and authenticity.
D)   Symmetric key cryptography uses a single secret key.

Question 18

Which of the following components of PKI performs the administrative functions, including verifying the identity of users and organizations requesting a digital certificate?

Accepted Answer

A)   Certification authority
B)   Registration authority
C)   Client nodes
D)   Digital certificate

Question 19

Which of the following is the process of creating a numeric value that represents the original text?

Accepted Answer