Architecture and Design
Which of the following describes the purpose of threat modeling?
Enumerate threats to the software
Define the correct and secure data flows in a program
Communicate testing requirements to the test team
Communicate threat and mitigation information across the development team
D. Threat modeling is a tool used to communicate information about threats and the mitigation procedures to all members of the development team.
The term STRIDE stands for what?
Spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege
Spoofing, tampering, reproducibility, information disclosure, denial of service, and elevation of privilege
Spoofing, tampering, reproducibility, information disclosure, discoverability, and elevation of privilege
Spoofing, tampering, repudiation, information disclosure, discoverability, and elevation of privilege
A. The term STRIDE refers to sources of threats: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
Reusing components to reduce risk is an example of what?
Leverage existing components
Separation of duties
Weakest link
Least common mechanism
A. Leveraging existing components reduces risk by using proven elements.
Race conditions can be determined and controlled via what?
Multithreading
Mutual exclusion
Race windows
Atomic actions
C. Race conditions are defined by race windows, a period of opportunity when concurrent threads can compete in attempting to alter the same object. They are caused by multithreading and are resolved through atomic actions under mutual exclusion conditions. The key is in detecting when they occur.
Verifying that code can perform in a particular manner under production conditions is a task managed by what?
Static analysis
Dynamic analysis
Production testing
Code walk-throughs
B. Testing of code while executing in a production-like environment is referred to as dynamic analysis.
On which platform can a customer deploy and operate arbitrary software across a cloud-based platform without worrying about the specifics of the environment?
Infrastructure as a service
Platform as a service
Software as a service
Architecture as a service
A. IaaS is a form of cloud computing that offers a complete platform as a provisioning solution to a computing need.
Bonus Points: define PaaS (+50) and Saas (+50)
Platform-neutral, interoperable, and modular with contract-based interfaces describes what?
SOA
XML
WSDL
ESB
A. SOA characteristics include platform neutrality, interoperability, modularity and reusability, abstracted business functionality, contract-based interfaces, and discoverability.
Bonus points: Define XML (+50), WSDL (+50), ESB (+50)
What is the advantage of unmanaged code?
Performance
Security
Library functions
Portability
A. Unmanaged code can have a performance advantage over unmanaged code.
Bonus Point: What is managed code and provide an example (+50)?
Elements of defensive coding include all of the following except what?
Custom cryptographic functions to avoid algorithm disclosure
Exception handling to avoid program termination
Interface coding efforts to avoid API-facing attacks
Cryptographic agility to make cryptographic functions stronger
A. Custom cryptographic functions are always a bad idea and frequently lead to failure.
RASP does not perform which of the following functions?
Connect to instrumentation during program operation
Monitor environmental condition under which the application operates
Examine code for race conditions
Alert operators when code has malfunctions
C. RASP does not examine the code base.
__________ is an architecture that can mimic desktop applications in usability and function.
RIA
NFC
REST
SOAP
A. Rich Internet applications (RIAs) are a form of architecture using the Web as a transfer mechanism and the client as a processing device, typically for display formatting control functions.
Bonus points for defining NFC (+50), REST (+50), SOAP (+50)
Which of the following are not elements associated with certificates?
RA
OSCP
CA
CLR
D. The common language (CLR) runtime is a Microsoft-specific hybrid language environment.
Bonus Points: Define RA, OSCP, CA, and CRL
+50 for each
Out-of-band management interfaces solve which of the following problems?
Require separate communication channel
Require less bandwidth
Reduce development risks
Reduce operational risks
D. Out-of-band management interfaces are less prone to interference from denial-of-service attacks against an application, reducing operational risk from loss of management control.
What mechanism can be employed to handle data issues that lead to out-of-range calculations?
Regular expressions
Vetted functions
Library calls
Exception handling
D. Exception handling can use business logic when elements are out of bounds, forcing overflow-type exceptions, for instance.
Static analysis can be used to check for what?
Approved function/library calls, examining rules and semantics associated with logic, and thread performance management
Syntax, approved function/library calls, and race conditions
Syntax, approved function/library calls, and memory management
Syntax, approved function/library calls, and examining rules and semantics associated with logic and calls
D. Static code analysis cannot test runtime issues such as thread performance, memory management, or race conditions.
Which of these statements accurately describes attack surface? (More than 1 answer)
Number of vulnerable lines of code
A good indicator of code quality
Number of elements available to attack
Not an indicator code quality
Number of elements available to attack
Not an indicator code quality
Which of these are types of common malware? (more than 1 answer)
Procreateware
Stealthware
Proliferative
Ransomware
Replicaware
Stealthware
Proliferative
Ransomware
What can be done in relation to services in order to harden the system configuration? (More than 1 answer)
Use default accounts
Use default folder locations
Encrypt connection strings
Eliminate unused services
Encrypt connection strings
Eliminate unused services
To deal with international distribution issues associated with cryptography, a clean method is via what?
Versioning
Use of international cryptography for all versions
Use of approved cryptographic libraries only
Use of cryptographic agility
D. Cryptographic agility can also assist in the international problem of approved cryptography. In some cases, certain cryptographic algorithms are not permitted to be exported to or used in a particular country. Rather than creating different source-code versions for each country, agility can allow the code to be managed via configurations.
Elements of defensive coding include all of the following except what?
Custom cryptographic functions to avoid algorithm disclosure
Exception handling to avoid program termination
Interface coding efforts to avoid API-facing attacks
Cryptographic agility to make cryptographic functions stronger
A. Custom cryptographic functions are always a bad idea and frequently lead to failure.
DREAD
A risk ranking (rating) methodology. Frequently used with STRIDE, the acronym stands for damage potential, reproducibility, exploitability, affected users, and discoverability.
Pervasive Computing
Also referred to as ubiquitous computing. It is about embedding capabilities (through microcontrollers) into everyday objects in our environment and providing them with storage, processing, and transmission capabilities. With all these objects connected to the internet, the basis for Internet of Things (IoT) was established.
Which of these are well-known legitimate types of session attacks that should be modeled and mitigated?
Token generated attack
Hijack attack
Burnt cookie attack
Man in the middle attack
Token generated attack
Man in the middle attack
Buffer Overflow
A reference to a situation where a process tries to place more data in a buffer than it has the capacity to hold. Buffer overflow can be caused by various conditions and in various ways, both on the stack and on the heap.
Obfuscation
A reference to the deliberate act of obscuring the code in various forms (e.g., source code, bytecode, object code). The objective is to either make the code difficult for humans to understand or to protect against decompiling and reverse-engineering. Ultimately, it is about the protection of intellectual properties.