A government agency is procuring a new authentication module for its .NET applications. The vendor claims the product has been evaluated under the Common Criteria. The agency wants to ensure the product meets a specific security functional requirement. What should the agency review to confirm this?

The OWASP Top 10 compliance report

The CVE entries for the product

The Security Target (ST) and the Evaluation Assurance Level (EAL)

A company processes credit card payments and is required to comply with PCI DSS. They are developing a new e-commerce application that will store cardholder data. Which of the following is a direct PCI DSS requirement that must be addressed during application development?

Ensure the application is hosted on a dedicated physical server

Implement strong encryption for cardholder data transmitted over open networks

Use only open-source components in the application

Obtain a Common Criteria certification for the application

What does an Evaluation Assurance Level (EAL) in Common Criteria represent?

The level of assurance that a product meets its security claims

The number of vulnerabilities found in a product

What is the primary purpose of OWASP OpenSAMM?

To provide a list of common vulnerabilities

To replace the need for penetration testing

To help organizations measure and improve their software security maturity

EC-CouncilCertified Application Security Engineer (.NET)

Domain 1Objective 4

Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 6)

Part of the Application Security Foundations domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 68 practice questions to prepare you well beyond it. (estimate)

68questions here

14free pages

22concepts

22 Concepts in This Objective

Software Security Standards Overview
OWASP Top 10
OWASP Software Assurance Maturity Model (SAMM)
ISO/IEC 27034
NIST Secure Software Development Framework (SSDF)
CWE and CVE
PCI DSS for Application Security
ISO/IEC 27001 and 27002
Security Models Overview
Bell-LaPadula Model
Biba Model
Clark-Wilson Model
Access Control Models
Secure Development Frameworks
Microsoft Security Development Lifecycle (SDL)
OWASP OpenSAMM
Building Security In Maturity Model (BSIMM)
Common Criteria
ISO/IEC 15408
COBIT for Application Security
ISO/IEC 27034-1
Security Frameworks Comparison

Questions 26–30

26application · medium
A government agency is procuring a new authentication module for its .NET applications. The vendor claims the product has been evaluated under the Common Criteria. The agency wants to ensure the product meets a specific security functional requirement. What should the agency review to confirm this?
Select an answer first
27application · medium
A company processes credit card payments and is required to comply with PCI DSS. They are developing a new e-commerce application that will store cardholder data. Which of the following is a direct PCI DSS requirement that must be addressed during application development?
Select an answer first
28foundation · easy
What does an Evaluation Assurance Level (EAL) in Common Criteria represent?
Select an answer first
29foundation · easy
Which of the following is a phase in the Microsoft Security Development Lifecycle (SDL)?
Select an answer first
30foundation · easy
What is the primary purpose of OWASP OpenSAMM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.