Software Security Standards, Models, and Frameworks CASEJAVA Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   A healthcare organization is developing a Java application that handles patient records. It must comply with data protection regulations. The security architect decides to use ISO/IEC 27034 as a guide. Which aspect of ISO/IEC 27034 is most directly relevant to ensuring the application meets regulatory requirements?

   • AThe standard's mandate to outsource security testing to third-party firms.
   • BThe standard's focus on integrating security into the application lifecycle, including risk assessment and control selection.
   • CThe standard's requirement to use a specific encryption algorithm for all data.
   • DThe standard's provision of a fixed set of security controls that all applications must implement.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   According to ISO/IEC 27034, what is the primary purpose of the 'Application Security Control' (ASC) concept?

   • ATo replace the need for security testing during development
   • BTo specify a single fixed set of security controls that all applications must implement
   • CTo define a set of security requirements that are applied to an application based on its risk assessment
   • DTo provide a certification scheme for secure application developers
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A software application must ensure that data is not modified by unauthorized users and that transactions are well-formed. Which security model best fits these requirements?

   • AClark-Wilson
   • BBell-LaPadula
   • CTake-Grant
   • DBiba
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise is adopting OWASP SAMM to improve its software security. The team has limited resources and must prioritize which SAMM practices to implement first. They have identified that their biggest risk is SQL injection in their Java applications. Which SAMM practice should they prioritize?

   • AEnvironment hardening, focusing on server configuration.
   • BGovernance, focusing on security policies and compliance.
   • CSecurity testing, specifically penetration testing.
   • DSecure coding practices, specifically input validation and parameterized queries.
   Reveal Solution Discussion Select an answer first