ISC2 Certified Secure Software Lifecycle Professional CSSLP Exam Practice Test

Answer : B

A hypervisor is a virtualization technique that allows multiple operating systems (guests) to run concurrently on a host computer. It is also

called the virtual machine monitor (VMM). The hypervisor provides a virtual operating platform to the guest operating systems and checks their

execution process. It provides isolation to the host's resources. The hypervisor is installed on server hardware.

Answer A is incorrect. Emulator duplicates the functions of one system using a different system, so that the second system behaves

like the first system.

Answer D is incorrect. CP/CMS is a time-sharing operating system of the late 60s and early 70s, and it is known for its excellent

performance and advanced features.

Answer C is incorrect. Grid computing refers to the combination of computer resources from multiple administrative domains to achieve

a common goal.

Answer : A, C, D, F

The security policy of a software system addresses the following important areas:

Access control

Data protection

Confidentiality

Integrity

Identification and authentication

Communication security

Accountability

Answer E and B are incorrect. Scalability and punctuality are not addressed by a software system's security policy.

Answer : C

Monitoring the computer hard disks or e-mails of employees pertains to the privacy policy of an organization.

Answer A is incorrect. The backup policy of a company is related to the backup of its data.

Answer D is incorrect. The network security policy is related to the security of a company's network.

Answer B is incorrect. The user password policy is related to passwords that users provide to log on to the network.

Answer : D

A simulation test is a method used to test the disaster recovery plans. It operates just like a structured walk-through test. In the simulation

test, the members of a disaster recovery team present with a disaster scenario and then, discuss on appropriate responses. These

suggested responses are measured and some of them are taken by the team. The range of the simulation test should be defined carefully for

avoiding excessive disruption of normal business activities.

Answer A is incorrect. The structured walk-through test is also known as the table-top exercise. In structured walk-through test, the

team members walkthrough the plan to identify and correct weaknesses and how they will respond to the emergency scenarios by stepping

in the course of the plan. It is the most effective and competent way to identify the areas of overlap in the plan before conducting more

challenging training exercises.

Answer B is incorrect. A full-interruption test includes the operations that shut down at the primary site and are shifted to the recovery

site according to the disaster recovery plan. It operates just like a parallel test. The full-interruption test is very expensive and difficult to

arrange. Sometimes, it causes a major disruption of operations if the test fails.

Answer C is incorrect. A parallel test includes the next level in the testing procedure, and relocates the employees to an alternate

recovery site and implements site activation procedures. These employees present with their disaster recovery responsibilities as they would

for an actual disaster. The disaster recovery sites have full responsibilities to conduct the day-to-day organization's business.

Answer : A, C, D

In eavesdropping, dumpster diving, and shoulder surfing, the attacker violates the confidentiality of a system without affecting its state.

Hence, they are considered passive attacks.

Answer : B

ESAPI (Enterprise Security API) is a group of classes that encapsulate the key security operations, needed by most of the applications. It is a

free, open source, Web application security control library. ESAPI provides an easy way to programmers for writing lower-risk applications and

retrofitting security into an existing application. It offers a solid foundation for new development.

Answer A is incorrect. Watermarking is the process of embedding information into software in a way that is difficult to remove.

Answer C is incorrect. Encryption wrapper dynamically encrypts and decrypts all the software code at runtime.

Answer D is incorrect. Code obfuscation is designed to protect code from decompilation.

Answer : B

Malicious file execution is a vulnerability that occurs when an application directly uses or concatenates potentially hostile input with data file or

stream functions. This leads to arbitrary remote and hostile data being included, processed, and invoked by the Web server. Malicious file

execution can be prevented by using an indirect object reference map, input validation, or explicit taint checking mechanism.

Answer D is incorrect. Injection flaw occurs when data is sent to an interpreter as a part of command or query.

Answer A is incorrect. Insecure cryptographic storage occurs when applications have failed to encrypt data.

Answer C is incorrect. Insecure communication occurs when applications have failed to encrypt network traffic.