Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 13)

Questions 61–65

1. 61foundation · easy

   Which of the following is a key principle of the Clark-Wilson integrity model?

   • ANo write down
   • BNo read up
   • CLeast privilege
   • DSeparation of duties
   Reveal Solution Discussion Select an answer first
2. 62application · medium

   A software company wants to adopt a secure development lifecycle that includes phases such as training, requirements, design, implementation, verification, release, and response. Which framework is this?

   • ACisco SDL
   • BMicrosoft SDL
   • CNIST SSDF
   • DOWASP SAMM
   Reveal Solution Discussion Select an answer first
4. 63application · medium

   A company wants to implement an access control model where the system administrator centrally defines permissions based on the user's job function, and users cannot change their own permissions. Which access control model should they use?

   • ARBAC
   • BClark-Wilson
   • CDAC
   • DMAC
   Reveal Solution Discussion Select an answer first
5. 64application · easy

   A healthcare organization is deploying a new patient-management system. They need to ensure that only users with specific job roles (e.g., doctor, nurse, administrator) can access certain patient records, and that permissions are granted based on the user's role, not on individual user discretion. Which access control model should they implement?

   • AAttribute-Based Access Control (ABAC)
   • BMandatory Access Control (MAC)
   • CDiscretionary Access Control (DAC)
   • DRole-Based Access Control (RBAC)
   Reveal Solution Discussion Select an answer first
6. 65application · medium

   A .NET web application allows users to upload profile pictures. The development team is concerned about the OWASP Top 10 risk of uploading malicious files. They plan to restrict uploads to JPEG and PNG files by checking the file extension and MIME type from the HTTP request, and then store the files in a folder with write permissions for the application pool. Which additional control is most essential to mitigate the risk?

   • ASet the folder's NTFS permissions to deny execute for the application pool identity.
   • BValidate the magic bytes of the file content against the declared type.
   • CRename the uploaded file to a random GUID with the original extension.
   • DStore the files in a database as binary large objects (BLOBs) instead of the file system.
   Reveal Solution Discussion Select an answer first