Secure software development summary questions¶

The questions are selected randomly for each student, and for these questions you will receive only correct/incorrect feedback. In each question of Problem 1, there is exactly one correct answer.

In Problem 2, each student will receive at least one correct option, usually several. For a partially correct answer, Plussa gives incorrect feedback, but Problem 2 is accepted when the score is 12 or higher, and the points are shown on a yellow background. Points begin to accumulate only when more than half of the selections in the exercise are correct. The score does not directly reveal whether an individual selection is correct or not.

Question 1

Select the correct option

SSDL means the same as SDL.

SDL is not suitable for small companies.

SDL means secure software.

SDL is not suitable for large companies.

Question 2

Select the correct option

SDLC means the same as SDL.

SDL is applied only during the software implementation phase.

SDL is not suitable for small companies.

SDL is not suitable for large companies.

Question 3

Select the correct options

SDL is a secure software development model developed by Microsoft.

SDL was developed by the United States federal government.

Microsoft kept its secure software development model secret so that other companies would not gain a competitive advantage.

SDL was developed by the NSA.

Question 4

Select the correct option

Static analysis replaces code reviews.

Simplicity reduces software errors.

In secure software development, there is no need to invest in user interface design because it is not part of security.

There is no need to strive for simplicity because customers demand as many features as possible from software.

Question 5

Select the correct option

Security requirements can be used to impose a requirement on software that the compiler must not produce any error messages.

Programmers do not need to understand the basics of cryptography because APIs handle everything automatically.

Since usability and security are in conflict with each other, they should be designed separately.

There is no need to strive for simplicity because software is inherently complex.

Question 6

Select the correct option

Training is kept separate from SDL.

Psychological acceptability of software means that users accept the risks of the software.

It is important for the programmer to know which cryptographic algorithms the software uses.

Least common mechanisms mean that file visibility is restricted through access permissions.

Select the correct statements. You may choose one or more options.

Question 1

In cloud services, particular attention must be paid to isolating users from one another.

RFID tags are used to identify IoT devices.

MUD makes it possible to restrict the network traffic of an IoT device.

Tampering is included in software threat modelling.

Repudiation is included in software threat modelling.

MUD is a tool for gamifying software development.

An SQL vulnerability in software can be detected through static analysis.

Economy of mechanism means optimising software production costs.

External software components should not be used because they cannot be trusted.

Dedicated secure software development guides exist for mobile systems.

Static analysis helps improve software quality but does not detect vulnerabilities.

The phases of secure software development are: Design, Implementation, Testing, and Maintenance.

Maintenance is not part of secure software development.

Fixing an error during the maintenance phase is the most expensive option.

Variables should be initialised to safe values.