8.3 - Assess the Effectiveness of Software Security CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In quantitative risk analysis, the Annualized Loss Expectancy (ALE) is calculated by which formula?

   • ASingle Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
   • BAsset Value (AV) ÷ Exposure Factor (EF)
   • CExposure Factor (EF) × Annualized Rate of Occurrence (ARO)
   • DAnnualized Rate of Occurrence (ARO) ÷ Single Loss Expectancy (SLE)
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the context of software security, what does risk assessment primarily involve?

   • AWriting secure code that is free from all vulnerabilities
   • BIdentifying and evaluating risks associated with software development, deployment, and operation
   • CDeploying the software to production as quickly as possible
   • DPurchasing the most expensive security tools available
   Reveal Solution Discussion Select an answer first
4. 8application · medium · select all that apply

   A security team is designing the audit logging strategy for a new e-commerce platform. Which of the following events should be logged to support security monitoring and incident response? (Select all that apply.)

   • AAll application error messages, including stack traces.
   • BSuccessful and failed authentication attempts.
   • CThe content of every HTTP request and response.
   • DAccess to customer payment card data.
   • EChanges to user privilege levels.
   Check answers Discussion Select an answer first
5. 9application · medium

   A development team is implementing a new audit logging system for a critical financial application. The compliance team requires that logs be available for forensic analysis for at least one year and that they cannot be altered by an attacker who compromises an application server. Which solution best meets these requirements?

   • AUse a write-once, read-many (WORM) storage solution for the logs.
   • BSend logs to a central SIEM and rely on its standard database retention.
   • CWrite logs to a local file on the application server and back them up nightly to a network share.
   • DEncrypt the log files with a key stored on the application server.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a change that should be logged and monitored for security purposes?

   • AA scheduled backup job completing successfully
   • BA modification to a system configuration file that was not part of an approved change request
   • CA user changing their own desktop wallpaper
   • DA user logging out of the application at the end of their shift
   Reveal Solution Discussion Select an answer first