Study Guide - Secure Development

1.- Develop the software to monitor its functionality and report when the
software is inactive and cannot provide the expected service to the company
a protection to ensure which of the following:
Confidentiality
b) Availability
c) Integrity
d) Authorization
2.- "The financial transactions processed in the system must use more than one
factor to verify the identity that requests access"What of the following
Does it include what was previously described?

a) Authorization
b) Authentication
c) Integrity
d) Availability
3.- The main reason for designing single sign-on capabilities is:
a) Allow interoperability between wireless and wired networks
b) It has the ability to verify each access request
c) Increase the security of authentication mechanisms
d) Simplify user authentication
4.- When the source code becomes dark using special programs to
dificultar la legibilidad del código cuando se divulga, el código también se conoce
as:
a) Obfuscated code
b) Coded message
c) Hash code
d) Object code
5.- Are database Triggers mainly useful for providing
Which of the following software detection assurance capabilities?
Audit
b) Availability
c) Authorization
d) Authentication
6.- Validation with Checksum can be used to satisfy which of the
following requirements:
a) Confidentiality
b) Integrity
c) Availability
d) Authentication
7.- Which of the following is a covert mechanism that ensures the
confidentiality?
a) Hashing
masking
c) Stenography
d) Encryption

8.- Infinite loops and incorrect memory calls pose threats to:
a) Availability
b) Authentication
c) Authorization
d) Responsibility
9.- The requirements identified to protect against destruction of the
information or the software itself are commonly referred to as:
a) Availability requirements
b) Integrity requirements
c) Confidentiality requirements
d) Authentication requirement
10.- Which of the following types of information is exempt from the requirements of
confidentiality?
a) Personal identification information
b) Data of the cardholder of the user
c) Software architecture
d) Directory information
11.- What is the Federal Information Processing Standard (FIPS) that
prescribe guidelines for biometric authentication?
a) FIPS 201
b) FIPS 140
c) FIPS 197
d) FIPS 186
12.- What is the MAIN reason why availability aspects of
software must be part of the software security initiatives of the
organization?
a) Software problems can cause downtime in the company.
b) Developers must be trained in continuity procedures.
business.
c) Software and data availability tests are often ignored.
d) Hackers like to carry out denial of service (DoS) attacks.
Denial of Service against the organization.
13.- The process of combining functions, variables, and dependency files and
Required libraries for the machine to run the program are known as:
a) Interpretation
b) Linking
c) Compilation
d) Instantiation
14.- The main security concern when implementing applications in the cloud
is related to
a) insecure APIs
b) Abuse of computer resources
c) Unauthorized access
d) Data breach or loss
15.- What is the MAIN reason for an application to be
susceptible to a Man-in-the-Middle (MITM) attack?
Inadequate session management
b) Lack of audit
c) Inadequate archiving
d) Lack of encryption
16.- The MAIN reason to incorporate security in the life cycle of
software development is to protect:
a) The unauthorized disclosure of information
b) Against hackers who intend to misuse the software
c) That developers do not release software with security flaws
d) The corporate brand and reputation
17.- The token that is primarily used for authentication in a
implementation of single sign-on, SSO (Single Sign On) between two companies
different is:
a) Security Assertion Markup Language (SAML)
b) One-time password (OTP)
c) Kerberos
d) Liberty Alliance ID-FF
18.- Which of the following is an activity that can be carried out to clarify the
requirements with business users using diagrams that model the
expected behavior of the software?
a) Threat modeling
b) Modeling of use cases
c) Modeling of misuse cases
d) Data modeling
19.- Which of the following is a multifaceted security standard that is used
to regulate organizations that collect, process, and/or store data from
cardholders as part of their business operations?
a) FIPS 201
b) NIST SP 800-64
c) ISO/IEC 15408
d) PCI DSS
20.- During a Threat Modeling Exercise, it is
review the software architecture to identify
attackers
b) Business impact
c) Critical assets
d) Entry points
21.- It is a scam practice in which malicious code is installed on a system or
server that redirects users to fraudulent websites without their knowledge or
user consent.
a) Phishing
b) Pharming
c) Spoofing
d) Vishing
22. The predominant form of malware affecting mobile devices is:
a) Virus
b) Ransomware
Worm
d) Spyware
23.- When the software is designed using the REST architecture, what is the
What good programming practices do you promote?
a) High cohesion
b) Low cohesion
c) Low coupling
d) High coupling
24.- What technique can be used to prevent automated filling of the
credentials, brute force, and stolen credential reuse attacks?
a) Multifactor authentication
b) Input validation
c) Encryption

d) Hashing
25.- Using multifactor authentication is effective in mitigating which of the following
attack risks:
a) Injection flaws
b) Man-in-the-Middle
c) Buffer overflow
d) Cross-Site Scripting
26.- Detailed error messages and unhandled exceptions can give
place to which of the following software security threats.
a) Manipulation
b) Spoofing
c) Rejection
d) Disclosure of information
27.- Which of the following is a characteristic of operating systems (OS)?
more recent ones that make it difficult for an attacker to guess the memory address of the
program, since it makes the memory address different each time it is
Does the program run?
a) Randomization of the address space layout (ASLR)
b) Data Execution Prevention (DEP)
c) Protection of the executable space
d) Security exception handler
28.- Which of the following side-channel techniques for detecting vulnerabilities
the injection used by an attacker when they make use of delayed error messages
between successful and unsuccessful consultations?

a) Distant observation
b) Synchronization (Timing)
c) Cold start
d) Energy analysis
29.- Why do most supervisory control and data acquisition systems
Are SCADA data susceptible to software attacks?
a) They were not initially implemented with security in mind.
b) The skills of hackers have increased significantly
c) The data they collect is classified as top secret
The firewalls that are installed in front of these devices have been breached.
30.- Which of the following components of the Java architecture is the main one?
responsible for ensuring the consistency of types, security, and guarantee of
that there are no malicious instructions in the code?

garbage collector
b) Class charger
c) Byte code verifier
d) Java security management
31.- It is used to communicate and enforce availability requirements of the
company or client:
Non-Disclosure Agreement (NDA)
b) Corporate contract
c) Service Level Agreements (SLA)
d) Threat model
32.- What is the acceptable number of user errors that the
organizations often predetermine before registering them as violations of
security?
a) Cutting level.
b) Known error.
c) Minimum security baseline.
d) Maximum tolerable downtime.
33.- What can we use to protect the internal functioning and structure?
internal database back-end against disclosure?
a) Triggers
b) Normalization
c) Views
d) Encryption

34.- WHAT IS THE ORGANIZATION THAT PUBLISHES THE TEN RISKS OF

d) Forums for security teams and incident response (FIRST)