CSSLP 試験練習問題

B

Correct answer: Attribute-based access control A company that grants access based on an employee's department, job function, or location is using attribute-based access control (ABAC). Several access control models exist, including:Official (ISC)² Guide to the CSSLP, 2nd Edition. Pg 113-120. CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 38-41.

C

Correct answer: Authentication The use of biometrics to verify identity in this scenario relates to authentication, which is the process of verifying the identity of individuals. Determining permissions for actions is an aspect of authorization. The question asks specifically about the identity verification process. Authentication: Verifying the identity of the user. Common authentication factors include something you know (passwords, etc.), something you have (smartphone, etc.), and something you are ( biometrics). Authorization: Validating that an authenticated user has the right to perform a particular action. Authorization can be managed via various access control models. Verification and validation are integral to authentication and authorization, respectively, but they are not valid security terms in this context.Official (ISC)² Guide to the CSSLP, 2nd Edition. Pg 11-15. CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 6-20.

B

Correct answer: Leveraging existing components Leveraging existing components encourages code reuse because it reduces an application's attack surface and the risk of new vulnerabilities being introduced into software. Least common mechanism prevents against sharing mechanisms or functions in code that are used by different users or processes if they have different levels of privilege. The principle of least privilege states that users, applications, etc. should only have the access and privileges needed to do their jobs. Separation of duties refers to the fact that critical processes (such as approving payments) should be split across multiple people to protect against fraud, social engineering, etc.Official (ISC)² Guide to the CSSLP, 2nd Edition. Pg 16-17. CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 33-37.

C

Correct answer: Least privilege The principle of least privilege states that users, applications, etc., should only have the access and privileges needed to do their jobs. Most users don't need admin privileges, so this practice creates security risks. Separation of duties refers to the fact that critical processes (such as approving payments) should be split across multiple people to protect against fraud, social engineering, etc. Psychological acceptability indicates that users are more likely to comply with security requirements that are easy to use and transparent. The need-to-know principle refers to restricting access to sensitive information, whereas the scenario describes excessive access privileges being granted to all users.CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 33-37. Official (ISC)² Guide to the CCSLP CBK, 2nd Edition. Pg 16-17.

D

Correct answer: Bug tracking Bug tracking is the process of recording known issues with software to be fixed in the future. Threat modeling identifies and describes potential threats to software, enabling mitigations to be implemented. Fuzzing automatically sends random and invalid inputs to a system to identify issues that could cause the program to crash or exhibit other undesirable behavior. Security reviews are periodic audits to validate that security processes are being properly performed during the software development lifecycle (SDLC).CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 24-25.