- (Exam Topic 1)
Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?
Correct Answer:
B
It is imperative that an application perform checks when each function or portion of the application is accessed, to ensure that the user is properly authorized to access it. Without continual checks each time a function is accessed, an attacker could forge requests to access portions of the application where authorization has not been granted.
- (Exam Topic 2)
Which of the following should NOT be part of the requirement analysis phase of the software development lifecycle?
Correct Answer:
D
Security requirements should be incorporated into the software development lifecycle (SDLC) from the earliest requirement gathering stage and should be incorporated prior to the requirement analysis phase.
- (Exam Topic 1)
Which of the following statements accurately describes VLANs?
Correct Answer:
A
A virtual area network (VLAN) can span any networks within a data center, or it can span across different physical locations and data centers.
- (Exam Topic 2)
Which security concept is focused on the trustworthiness of data?
Correct Answer:
A
Integrity is focused on the trustworthiness of data as well as the prevention of unauthorized modification or tampering of it. A prime consideration for maintaining integrity is an emphasis on the change management and configuration management aspects of operations, so that all modifications are predictable, tracked, logged, and verified, whether they are performed by actual human users or systems processes and scripts.
- (Exam Topic 3)
Within an IaaS implementation, which of the following would NOT be a metric used to quantify service charges for the cloud customer?
Correct Answer:
B
Within IaaS, where the cloud customer is responsible for everything beyond the physical network, the number of users on a system would not be a factor in billing or service charges. The core cloud services for IaaS are based on the memory, storage, and CPU requirements of the cloud customer. Because the cloud customer with IaaS is responsible for its own images and deployments, these components comprise the basis of its cloud provisioning and measured services billing.
