Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization wants to measure its current software security maturity and create a roadmap for improvement. They need a framework that provides a structured way to assess and improve security practices across business functions. Which framework should they use?

   • ACommon Criteria
   • BCOBIT
   • CBSIMM
   • DOWASP OpenSAMM
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company processes credit card payments through a custom .NET web application. They are preparing for a PCI DSS assessment. The development team wants to ensure the application meets the relevant PCI DSS requirements. Which of the following is a direct PCI DSS requirement for the application layer?

   • ADevelop applications based on secure coding standards and review custom code for vulnerabilities.
   • BEncrypt all cardholder data in transit and at rest using strong cryptography.
   • CImplement multi-factor authentication for all remote network access.
   • DRestrict physical access to the data center where the application servers are hosted.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security manager wants to assess the maturity of their organization's software security practices and create a roadmap for improvement. They have limited budget and need a framework that provides a structured, measurable approach with defined maturity levels. Which framework is most suitable?

   • ABSIMM
   • BMicrosoft SDL
   • COWASP SAMM
   • DCommon Criteria
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a practice group in the NIST SSDF?

   • AMonitor Network Traffic (MN)
   • BPrepare the Organization (PO)
   • CEncrypt All Data (ED)
   • DHarden the Infrastructure (HI)
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   A security analyst is reviewing a vulnerability scan report that lists a specific issue in a .NET library used by their application. The report includes a CVE identifier and a CWE identifier. The analyst wants to understand the nature of the weakness and also check if a fix is available. Which action best uses these identifiers?

   • AUse the CWE to search for the exact patch, and the CVE to determine the severity rating.
   • BLook up the CVE to understand the weakness class, and the CWE to find the specific vulnerability and its patch.
   • CUse the CVE to identify the weakness class and the CWE to identify the affected product version.
   • DLook up the CWE to understand the weakness class, and the CVE to find the specific vulnerability and its patch.
   Reveal Solution Discussion Select an answer first