LORDSINSTITUTEOFENGINEERINGANDTECHNOLOGY

Approved by AICTE | Recognized by Government of Telangana | Affiliated to Osmania University

Accredited by NBA | Accredited with ‘A’ grade by NAAC | Accredited by NABL
Examination Branch
Branch: CSM

CIE-II QUESTION BANK

Course Name SECURE SOFTWARE Year/Sem IV/VIII
ENGINEERING
Course Code PE853CSM Month/Year JUNE/2024

Name of the Faculty: Mrs. SHEREEN UZMA

S No. SAQ’s Marks CO BTL

UNIT -III

1 Write 3 Security guidelines. 1 3 1

Implement strong authentication, regularly update systems, and

provide security awareness training to enhance organizational
security posture.

2 Define Attack patterns. 1 3 1

Attack patterns are standardized methods used by attackers

to exploit vulnerabilities in systems, networks, or
applications, guiding security professionals in
understanding and defending against common cyber threats.
3 What is coding practices? 1 3 1

Coding practices are guidelines and conventions followed

by developers when writing code to ensure readability,
maintainability, and efficiency of software projects.
4 Define properties of Software Security Testing. 1 3 1

Properties of software security testing define its

effectiveness, scope, and characteristics, including
coverage, accuracy, reproducibility, scalability, efficiency,
automation, comprehensiveness, adaptability, relevance,
and reporting.
UNIT -IV

5 What is Security Failures? 1 4 1

 Security failures are instances where security measures are
compromised, leading to unauthorized access, data
breaches, or other security incidents, often due to
vulnerabilities, misconfigurations, human errors, or
malicious attacks.
6 How do you manage system complexity. 1 4 1
Break down complex systems, prioritize core functionalities, and
continuously improve through modular design and monitoring.

7 Write four requirements elicitation techniques? 1 4 1

Use interviews, document analysis, brainstorming, and focus
groups to uncover system needs.

8 What is Security complexity? 1 4 1

Security complexity refers to the challenge of securing systems
that have many moving parts, making them harder to manage
and leaving more potential openings for attackers.expand_more

UNIT -V

7 What are the 5 basic principle of security explain? 1 5 1

The CIA triad (Confidentiality, Integrity, Availability) with
Authentication and Non-repudiation ensures authorized access to
accurate, reliable info that can't be denied.

8 Write a short on Security project Management. 1 5 1

Security project management integrates security throughout the

project lifecycle to protect data and systems

9 write about software security framework. 1 5 1

Software security frameworks offer a structured approach to
secure the entire software development lifecycle by outlining
best practices and procedures.

10 Define SDLC. 1 5 1
SDLC stands for Software Development Life Cycle. It's a
structured process for planning, creating, testing, and deploying
 high-quality software applications.

S No. LAQ’s Marks CO BTL

UNIT -III

1 Explain security testing in SDLC?. 7 3 2

Security testing in the Software Development Life Cycle

(SDLC) involves assessing the security of a software
system from its inception to deployment and maintenance
stages. It begins with identifying and documenting security
requirements in the requirements phase and integrating
security considerations into the design and development
phases. During testing, various techniques such as
vulnerability assessments, penetration testing, code reviews,
and compliance testing are employed to identify and
mitigate security vulnerabilities. Before deployment, the
software undergoes a final round of testing to ensure that all
vulnerabilities are addressed. Throughout the maintenance
phase, ongoing security testing and monitoring are
conducted to detect and respond to new security threats and
vulnerabilities, ensuring the software remains secure and
resilient. By integrating security testing into each phase of
the SDLC, organizations can mitigate security risks and
deliver secure software systems that meet regulatory
requirements and industry standards.
2 Differentiate between code analysis and Coding 7 3 3
Practices.
Code analysis involves examining source code for
defects, vulnerabilities, and adherence to coding
standards, focusing on code quality, correctness, and
security. It can be performed using automated tools or
manual reviews and helps improve code quality,
identify security vulnerabilities early, and ensure
adherence to coding standards. On the other hand,
coding practices refer to the guidelines and conventions
developers follow when writing code, aiming to
produce clean, readable, maintainable, and efficient
code. They cover aspects such as naming conventions,
code structure, commenting, error handling, and
modularization, and help ensure consistency across the
codebase while promoting collaboration among
developers. Both code analysis and coding practices are
essential for producing high-quality, secure software
systems.
3 Explain secure software design with diagram. 7 3 2

Secure software design involves integrating security

considerations into the architectural decisions and design
principles of software systems from the outset. This
includes implementing multiple layers of security, such as
perimeter security, network security, application security,
and data security, to protect against various threats and
attacks. Access control mechanisms, encryption techniques,
input validation and sanitization, error handling and
logging, and the principle of least privilege are applied to
mitigate security risks and vulnerabilities. Secure
configuration practices and secure communication channels
are established to ensure that software components and
infrastructure are securely configured and that data is
transmitted securely. Additionally, threat modeling
techniques are utilized to identify potential security threats
and attack vectors early in the design phase, allowing for
proactive risk mitigation and security controls
implementation. By incorporating these components and
principles into the software design, organizations can
develop secure and resilient software systems that safeguard
sensitive information and resources effectively.
UNIT -IV

4 Explain the challenges faced in the SDLC model? 7 4 2

The Software Development Life Cycle (SDLC) model faces

several challenges that can hinder the success of software
projects. These include evolving requirements leading to
scope creep, communication gaps causing
misunderstandings, and time and resource constraints
resulting in rushed development. Integration issues with
existing systems, overlooked security risks, and inadequate
quality assurance can further complicate projects. Rapid
technological changes, insufficient stakeholder
involvement, and skill gaps within the team also pose
significant obstacles. Overcoming these challenges requires
flexibility, continuous engagement with stakeholders,
effective communication, and a strong focus on planning
and quality throughout the development process.
5 Discuss Deep Technical Problem Complexity. 7 4 2

Deep technical problem complexity involves intricate

challenges that require specialized knowledge, advanced
skills, and innovative solutions. These problems are
characterized by interdependencies within systems, large-
scale data or processes, and the need for cutting-edge
expertise in areas like algorithms and machine learning. The
dynamic nature of technology, multidisciplinary
 collaboration, and inherent uncertainties add to the
difficulty. Moreover, significant time, financial, and
computational resources are often required. Addressing
these complexities demands strategic coordination,
continuous learning, and creative problem-solving to
develop effective and reliable solutions.
6 Explain Functional and Attacker Perspectives for 7 4 3
security.

The functional perspective in security focuses on designing,

implementing, and managing security measures to protect
systems, involving secure coding, access controls,
continuous monitoring, incident response, and compliance
auditing. Conversely, the attacker perspective aims to
understand how attackers might exploit system
vulnerabilities through reconnaissance, exploitation,
privilege escalation, persistence, and data exfiltration. By
integrating these perspectives, organizations can better
protect their systems by building robust security measures
and anticipating potential attack methods, ensuring a
comprehensive defense against security threats.
UNIT -V

7 What are enterprise security frameworks?? 7 5 1

Enterprise security frameworks are structured

methodologies that guide organizations in managing and
enhancing their overall security posture. These frameworks,
such as ISO/IEC 27001, NIST Cybersecurity Framework,
and COBIT, offer a set of best practices, standards, and
controls for identifying, assessing, and mitigating security
risks across technology, processes, and people. They help
organizations align their security strategies with business
objectives and regulatory requirements, providing a
systematic approach to managing sensitive information,
governing IT processes, and mitigating cyber threats. By
implementing these frameworks, organizations can improve
their security resilience, demonstrate compliance with
industry standards, and enhance trust with stakeholders.
8 Explain 5 levels of process maturity?. 7 5 3

The five levels of process maturity, as outlined in the

Capability Maturity Model Integration (CMMI), represent
different stages of process development within an
organization. At the initial level, processes are ad hoc and
chaotic, with little structure or consistency. As
organizations progress to the managed level, basic project
management practices are established to provide structure
and control. At the defined level, processes become well-
 documented and standardized across the organization,
leading to greater consistency and repeatability.
Quantitative management at level four introduces data-
driven analysis to manage process performance, while the
optimizing level emphasizes continuous innovation and
improvement to sustain high performance. Progressing
through these levels enables organizations to enhance their
ability to deliver high-quality products and services, meet
customer expectations, and achieve strategic objectives.
9 Explain Security and Project Management . 7 5 2
Security and project management are closely intertwined
disciplines essential for ensuring the success, integrity, and
resilience of projects within an organization. Integrating security
into project management involves identifying security
requirements, conducting risk assessments, and developing
appropriate security plans and controls to mitigate potential
threats and vulnerabilities. Both disciplines involve risk
management, compliance with regulatory requirements, effective
communication, collaboration, and change management. By
working together, project managers and security professionals
can effectively manage security risks, comply with regulatory
requirements, and deliver projects that meet stakeholder
expectations while ensuring the confidentiality, integrity, and
availability of information and systems throughout the project
lifecycle.