Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a key component of an ISMS as defined by ISO/IEC 27001?

   • APenetration testing of all applications
   • BUse of a specific security software product
   • CImplementation of a firewall in every network segment
   • DRisk assessment and treatment
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary focus of ISO/IEC 27034-1?

   • ADefining network security protocols
   • BProviding an application security control framework
   • CProviding a list of common vulnerabilities
   • DSpecifying encryption algorithms
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which security model is primarily focused on protecting confidentiality?

   • AChinese Wall
   • BBell-LaPadula
   • CClark-Wilson
   • DBiba
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the Common Criteria, what is a Protection Profile (PP)?

   • AA document that describes the security features of a specific product
   • BA list of known vulnerabilities in a product
   • CA set of security requirements for a class of products
   • DA certificate issued after evaluation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A multinational organization is adopting ISO/IEC 27034 to integrate application security into its software development lifecycle. They have defined organizational security objectives and are now selecting security controls for a new customer-facing .NET application. According to ISO/IEC 27034, what should guide this control selection?

   • AThe Common Criteria protection profile that matches the application's functional class.
   • BThe Application Security Control (ASC) framework and the application's risk assessment results.
   • CThe Microsoft SDL phases, which define mandatory security activities for every project.
   • DThe OWASP Top 10 list, applied uniformly to all applications regardless of context.
   Reveal Solution Discussion Select an answer first