ISC CSSLP - Certified Secure Software Lifecycle Professional Exam
Page: 3 / 70
Total 350 questions
Question #11 (Topic: Volume A)
Which of the following models uses a directed graph to specify the rights that a subject can transfer to an object or that a subject can take from another subject?
A. Take-Grant Protection Model
B. Biba Integrity Model
C. Bell-LaPadula Model
D. Access Matrix
Answer: A
Question #12 (Topic: Volume A)
You are the project manager for GHY Project and are working to create a risk response for a negative risk. You and the project team have identified the risk that
the project may not complete on time, as required by the management, due to the creation of the user guide for the software you're creating. You have elected to
hire an external writer in order to satisfy the requirements and to alleviate the risk event. What type of risk response have you elected to use in this instance?
the project may not complete on time, as required by the management, due to the creation of the user guide for the software you're creating. You have elected to
hire an external writer in order to satisfy the requirements and to alleviate the risk event. What type of risk response have you elected to use in this instance?
A. Transference
B. Exploiting
C. Avoidance
D. Sharing
Answer: C
Question #13 (Topic: Volume A)
Which of the following organizations assists the President in overseeing the preparation of the federal budget and to supervise its administration in Executive
Branch agencies?
Branch agencies?
A. OMB
B. NIST
C. NSA/CSS
D. DCAA
Answer: Answer: D is incorrect. The DCAA has the aim to monitor contractor costs and perform contractor audits. Answer: C is incorrect. The National Security Agency/
Question #14 (Topic: Volume A)
Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the
configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which
one?
configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which
one?
A. Configuration Identification
B. Configuration Verification and Auditing
C. Configuration Status Accounting
D. Configuration Item Costing
Answer: D
Question #15 (Topic: Volume A)
Which of the following types of redundancy prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter
data?
data?
A. Data redundancy
B. Hardware redundancy
C. Process redundancy
D. Application redundancy
Answer: C
