CISSP Official Practice Tests by Mike Chapple, David Seidl

192 Chapter 8 ■ Software Development Security (Domain 8)

74. What part of the security review process are the input parameters shown in the diagram
    used for?

Configuration

input

parameters

User input

parameters

Control input

parameters

Parameter

tracking through

code

Back-end

input

parameters

A. SQL injection review

B. Sprint review

C. Fagan inspection

D. Attack surface identification

75. What application security process can be described in these three major steps?
    
    
    1. Decomposing the application
    
    
    2. Determining and ranking threats
    
    
    3. Determining countermeasures and mitigation
       A. Fagan inspection
       B. Threat modeling
       C. Penetration testing
       D. Code review
    
    
    
    


76. Which one of the following approaches to failure management is the most conservative
    from a security perspective?
    A. Fail open
    B. Fail mitigation
    C. Fail clear
    D. Fail closed