Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 12)

Questions 56–60

1. 56foundation · easy

   Which access control model uses security labels to determine access decisions?

   • ADiscretionary Access Control (DAC)
   • BRule-Based Access Control
   • CRole-Based Access Control (RBAC)
   • DMandatory Access Control (MAC)
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is the primary purpose of the COBIT framework?

   • ATo provide a list of common vulnerabilities
   • BTo replace the need for security testing
   • CTo provide a framework for governance and management of enterprise IT
   • DTo certify software products
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   What is the primary application of the Bell-LaPadula model?

   • AMilitary and government systems that require strict confidentiality
   • BDatabase systems that require data integrity
   • CSocial media platforms that need to prevent spam
   • DE-commerce systems that require high availability
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   Which of the following is an example of a widely recognized software security standard?

   • AISO/IEC 27034
   • BHTML5
   • CRFC 2616
   • DIEEE 802.11
   Reveal Solution Discussion Select an answer first
6. 60expert · hard

   A large organization is adopting ISO/IEC 27034-1 to standardize application security across multiple development teams. They have different types of applications, from internal tools to high-risk customer-facing systems. The security team wants to implement a consistent approach that allows for risk-based control selection while maintaining organizational oversight. Which approach aligns with ISO/IEC 27034-1?

   • ADelegate all security control decisions to individual development teams without central oversight.
   • BUse the OWASP Top 10 as the sole basis for security controls for all applications.
   • CDefine a set of organization-wide security requirements and use the Application Security Control (ASC) framework to select controls based on each application's risk assessment.
   • DApply the same set of security controls to all applications to ensure uniformity and simplify compliance.
   Reveal Solution Discussion Select an answer first