Secure-Software-Design 試験問題を無料オンラインアクセス

A security architect is creating a data flow diagram and draws an arrow between two circles.
What does the arrow represent?

• A.External Entity
• B.Data Flow
• C.Data Store
• D.Process

Which category classifies identified threats that have some defenses in place and expose the application to limited exploits?

• A.Unmitigated Threats
• B.Fully Mitigated Threat
• C.Partially Mitigated Threat
• D.Threat Profile

An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:

Which technique should be used to detect this vulnerability without running the source codes?

• A.Cross-site scripting
• B.Dynamic analysis
• C.Fuzz testing
• D.Static analysis

Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?

• A.Session Management
• B.Memory Management
• C.Data Protection
• D.Input Validation

What is a countermeasure to the web application security frame (ASF) authentication threat category?

• A.Sensitive information is scrubbed from error messages
• B.Cookies have expiration timestamps.
• C.Role-based access controls restrict access
• D.Credentials and tokens are encrypted.