QUESTION 34
Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company’s customer portal. The base score of the vulnerability was 9.9 and changed to 8.0 after adjusting temporal and environmental metrics.
Which rating would CVSS assign this vulnerability?

QUESTION 35
Which privacy impact statement requirement type defines processes to keep personal information updated and accurate?

QUESTION 36
Which step in the change management process includes modifying the source code?

QUESTION 37
Which design and development deliverable contains the results of each type of evaluation that was performed and the type and number of vulnerabilities discovered?

QUESTION 38
After being notified of a vulnerability in the company’s online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab.
What is the response team’s next step?

QUESTION 39
Which threat modeling step collects exploitable weaknesses within the product?

QUESTION 40
Which category classifies identified threats that do not have defenses in place and expose the application to exploits?

QUESTION 41
In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?

QUESTION 42
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?

QUESTION 43
Which DREAD category is based on how easily a threat exploit can be found?

QUESTION 44
Which security assessment deliverable defines measures that can be periodically reported to management?

QUESTION 45
Company leadership has discovered an untapped revenue stream within its customer base and wants to meet with IT to share its vision for the future and determine whether to move forward.
Which phase of the software development lifecycle (SDLC) is being described?

QUESTION 46
Which category classifies identified threats that have defenses in place and do not expose the application to exploits?

QUESTION 47
What is the last slop of the SDLOSDL code review process?

QUESTION 48
Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?

QUESTION 49
Which security assessment deliverable identities unmanaged code that must be kept up to date throughout the life of the product?

QUESTION 50
Due to positive publicity from the release of the new software product, leadership has decided that it is in the best interests of the company to become ISO 27001 compliant. ISO 27001 is the leading international standard focused on information security.
Which security development life cycle deliverable is being described?

QUESTION 51
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:

Which technique should be used to detect this vulnerability without running the source codes?

QUESTION 52
What refers to the review of software source code by developers other than the original coders to try to identify oversights, mistakes, assumptions, a lack of knowledge, or even experience?

QUESTION 53
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?

QUESTION 54
In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?