Software Security Standards, Models, and Frameworks CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services company is adopting ISO/IEC 27034 to guide its secure application development process. During the planning phase for a new Java-based payment portal, the security team must decide how to apply the standard's requirements. Which action best aligns with ISO/IEC 27034's framework?

   • AUse the standard only for post-release security testing, not during development.
   • BApply a fixed set of security controls from the standard to every application regardless of risk level.
   • CReplace the organization's existing security policies with the standard's recommended controls.
   • DDefine application security controls based on the organization's risk assessment and integrate them into the development lifecycle.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A large enterprise wants to benchmark its software security initiatives against industry peers and identify best practices from real-world organizations. They are looking for a framework that is based on observed industry practices rather than a prescriptive maturity model. Which framework should they use?

   • AISO/IEC 27034
   • BBiba
   • CBSIMM
   • DOWASP SAMM
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A software company is using BSIMM to benchmark its security practices. The assessment reveals that the company scores low in the 'Security Testing' practice. The company has a limited budget and must decide how to improve. Which action is most aligned with BSIMM's guidance for improving security testing?

   • AHire more security testers to perform manual testing on every release.
   • BIncrease the frequency of penetration testing and integrate automated security testing into the CI/CD pipeline.
   • CFocus only on static analysis and ignore dynamic testing.
   • DOutsource all security testing to a third-party vendor.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is developing a Java application for a client that requires compliance with ISO/IEC 27034. The client also wants to use the Biba integrity model for certain modules. The development team is concerned about the additional effort. What is the best way to reconcile these requirements?

   • AIgnore Biba because ISO/IEC 27034 does not mention it.
   • BApply Biba to the entire application to ensure full compliance with the client's request.
   • CUse Clark-Wilson instead of Biba because it is more comprehensive.
   • DUse ISO/IEC 27034's risk assessment to determine where Biba's integrity controls are necessary, and implement them only in those modules.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software company wants to systematically improve its secure development practices. The team is considering adopting OWASP SAMM. What is the primary benefit of using SAMM over a one-time security training session?

   • AIt guarantees compliance with ISO/IEC 27034.
   • BIt replaces the need for any other security standards or frameworks.
   • CIt provides a continuous framework to assess, improve, and measure security practices across the SDLC.
   • DIt automatically fixes vulnerabilities in the codebase.
   Reveal Solution Discussion Select an answer first