What is an advantage of using the Agile development methodology?
Correct Answer: B
Question 17
Which category classifies identified threats that have some defenses in place and expose the application to limited exploits?
Correct Answer: D
Question 18
Due to positive publicity from the release of the new software product, leadership has decided that it is in the best interests of the company to become ISO 27001 compliant. ISO 27001 is the leading international standard focused on information security. Which security development life cycle deliverable is being described?
Correct Answer: D
Comprehensive and Detailed In-Depth Explanation: ISO/IEC 27001 is an international standard that outlines the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Achieving ISO 27001 certification demonstrates an organization's commitment to information security and provides assurance to customers and stakeholders that security best practices are in place. In the context of the software development life cycle (SDLC), post-release certifications refer to obtaining formal certifications, such as ISO 27001, after a product has been developed and released. This process involves a comprehensive assessment of the organization's information security practices to ensure they align with the standards set forth by ISO 27001. The certification process typically includes: * Gap Analysis: Evaluating existing information security measures against ISO 27001 requirements to identify areas needing improvement. * Implementation: Addressing identified gaps by implementing necessary policies, procedures, and controls. * Internal Audit: Conducting internal audits to verify the effectiveness of the ISMS and readiness for external assessment. * External Audit: Engaging an accredited certification body to perform a thorough evaluation, leading to certification if compliance is demonstrated. By pursuing ISO 27001 certification post-release, the company aims to enhance its security posture, comply with international standards, and build trust with its customer base. References: * ISO/IEC 27001:2022 - Information Security Management Systems
Question 19
Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?
Correct Answer: A
Question 20
Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?
Correct Answer: B
The software control test that examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output is known as black box testing. This testing method focuses on the functionality of the application rather than its internal structures or workings. Testers provide inputs and examine outputs without knowing how and where the inputs are worked upon. It's designed to test the system' s external behavior. * Black box testing is used to verify that the system meets the requirements and behaves as expected in various scenarios, including edge cases and incorrect input data. It helps in identifying discrepancies between the system's actual functionality and its specified requirements. * This type of testing is applicable across various levels of software testing, including unit, integration, system, and acceptance testing. It is particularly useful for validating user stories and use cases during the software development process. * Since black box testing treats the software as a "black box", it does not require the tester to have knowledge of the programming languages or the system's implementation. This allows testers to objectively test the software's behavior and performance. References: The concept of black box testing is well-documented and is a standard practice in secure software design, as outlined by sources such as LambdaTest1 and other industry best practices.
