CSSLP 試験練習問題

C

Correct answer: Open design Open design is the opposite of security by obscurity and states that the security of software shouldn't depend on its design remaining secret. Psychological acceptability indicates that users are more likely to comply with security requirements that are easy to use and transparent. Defense in depth means that multiple layers of security should be used so that a failure of one layer doesn't leave the system vulnerable. Fail secure means that a system should default to a secure state if something goes wrong, rather than an insecure one. For example, magnetic locks on a secure area should be locked if they lose power.CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 33-37. Official (ISC)² Guide to the CCSLP CBK, 2nd Edition. Pg 16-17.

A

Correct answer: Security review Security Review is the most likely process to have failed because it is responsible for validating that security processes, including deploying critical fixes, are being properly performed. Security reviews are periodic audits to validate that security processes are being properly performed during the software development lifecycle (SDLC). Bug tracking is the process of recording known issues with software to be fixed in the future. Threat modeling identifies and describes potential threats to software, enabling mitigations to be implemented. Fuzzing automatically sends random and invalid inputs to a system to identify issues that could cause the program to crash or exhibit other undesirable behavior.CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 24-25.

A

Correct answer: Least Privilege Least Privilege involves granting users only the necessary access to perform their tasks. This principle is applied in the scenario, where the user is only given access to specific resources. Separation of Duties (SoD), on the other hand, focuses on dividing tasks among multiple users to prevent fraud or errors, rather than limiting access to specific resources. Some of the key security design principles include:Official (ISC)² Guide to the CSSLP, 2nd Edition. Pg 16-17. CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 33-37.

A

Correct answer: Least common mechanism Least common mechanism prevents against sharing mechanisms or functions in code that are used by different users or processes if they have different levels of privilege. Leveraging existing components encourages code reuse because it reduces the risk of new vulnerabilities being introduced into software. Economy of mechanism (also known as the Keep it Simple principle) states that software design and implementation should be as simple as possible to reduce the risk of errors. The principle of least privilege states that users, applications, etc. should only have the access and privileges needed to do their jobs.Official (ISC)² Guide to the CSSLP, 2nd Edition. Pg 16-17. CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 33-37.

D

Correct answer: Preventative This role-based access control (RBAC) system describes a preventative security control. It restricts access to sensitive financial data based on employees' job functions, preventing unauthorized access. By granting access only to those who need it, the system prevents potential security incidents from occurring, making it a preventative measure. The three main ways to manage security risks in production include: Proactive security actions would involve threat hunting or similar activities.CSSLP Certification All-in-One Exam Guide, 3rd Edition. Pg 44.