Software Security Standards, Models, and Frameworks CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which security framework is open-source and provides a self-assessment model with 'business functions' and 'security practices' to help organizations implement and measure their software assurance program?

   • ABSIMM
   • BCMMI
   • COWASP SAMM
   • DISO/IEC 27034
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is developing a Java application that will be sold to multiple clients in different industries. The security team wants to ensure that the application's security controls are appropriate for each client's risk profile. Which approach aligns with ISO/IEC 27034?

   • AConduct a risk assessment for each client and tailor the security controls accordingly.
   • BApply only the minimum controls required by law, regardless of client risk.
   • CLet each client define their own security controls without guidance.
   • DUse the same set of high-security controls for all clients to simplify deployment.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A defense contractor is building a Java application that handles both classified and unclassified data. The security architect must choose a security model that prevents unauthorized disclosure (confidentiality) while also ensuring that data is not corrupted (integrity). The architect is considering Bell-LaPadula and Biba. Which approach best addresses both concerns?

   • AImplement Bell-LaPadula for confidentiality and Biba for integrity, but be aware of the conflict between the two models.
   • BUse only Bell-LaPadula because confidentiality is more important than integrity in this context.
   • CUse only Biba because integrity is more important than confidentiality in this context.
   • DUse Clark-Wilson because it enforces both confidentiality and integrity.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A development team is adopting a software security standard to guide secure application development across the organization. Which standard is specifically designed to provide a framework for managing application security throughout the application lifecycle?

   • APCI DSS
   • BISO/IEC 27034
   • CNIST SP 800-53
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A large enterprise is evaluating BSIMM to benchmark its software security initiatives. The team wants to compare its practices against industry peers. What is the most appropriate use of BSIMM in this context?

   • AUse BSIMM to replace its internal security policies and procedures.
   • BUse BSIMM's framework to assess the maturity of its security activities and identify areas for improvement.
   • CUse BSIMM as a prescriptive standard to dictate exact security controls for every project.
   • DUse BSIMM to automatically generate security requirements for each application.
   Reveal Solution Discussion Select an answer first