Software Security Standards, Models, and Frameworks CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A defense contractor is developing a Java-based document management system that will handle classified military data. The security team mandates that no information can flow from a higher classification level to a lower one, and that users cannot read documents above their clearance. Which security model should the design team apply to enforce these access restrictions?

   • ABiba
   • BOWASP SAMM
   • CClark-Wilson
   • DBell-LaPadula
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A multinational corporation is developing a Java application that will be deployed in multiple countries with varying data protection laws. The security team wants to use ISO/IEC 27034 to guide the development. What is the most important consideration when applying the standard in this context?

   • AThe standard provides a list of approved encryption algorithms for all countries.
   • BThe standard's risk assessment process must account for the legal and regulatory requirements of each country.
   • CThe standard mandates a single set of controls that satisfies all countries' laws.
   • DThe standard requires all data to be stored in the country of origin.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization wants to adopt a security framework that provides a structured way to measure the effectiveness of its secure coding practices. The team is considering both OWASP SAMM and BSIMM. Which statement correctly distinguishes between the two?

   • ASAMM is a certification standard, while BSIMM is a training program.
   • BSAMM is prescriptive and provides a roadmap for improvement, while BSIMM is descriptive and reflects common industry practices.
   • CSAMM focuses on runtime security, while BSIMM focuses on development practices.
   • DSAMM is only for web applications, while BSIMM covers all software types.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial application processes transactions that must not be corrupted by lower-integrity data. The security architect wants to ensure that a high-integrity process cannot read data from a low-integrity source, and that low-integrity subjects cannot write to high-integrity objects. Which security model should be used?

   • ABell-LaPadula
   • BISO/IEC 27034
   • CClark-Wilson
   • DBiba
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which security model is primarily designed to enforce confidentiality by preventing information from flowing from a higher classification level to a lower one?

   • ABell-LaPadula
   • BChinese Wall
   • CBiba
   • DClark-Wilson
   Reveal Solution Discussion Select an answer first