ちなみに、Japancert Secure-Software-Designの一部をクラウドストレージからダウンロードできます：https://drive.google.com/open?id=1DyUmgpD6ANI5LODWzdhxcsEc5-NUvPNx
Japancertについてどのくらい知っているのですか。JapancertのSecure-Software-Design試験問題集を利用したことがありますか。あるいは、知人からJapancertを聞いたことがありますか。IT認定試験に関連する参考書のプロな提供者として、Japancertは間違いなくあなたが今まで見た最高のサイトです。なぜこのように確かめるのですか。それはJapancertのように最良のSecure-Software-Design試験参考書を提供してあなたに試験に合格させるだけでなく、最高品質のサービスを提供してあなたに100％満足させることもできるサイトがないからです。
| Section | Objectives |
|---|---|
| Secure Software Concepts | - Governance, Risk, and Compliance (GRC)
|
| Secure Deployment and Maintenance | - Secure Deployment
|
| Security Requirements and Design | - Secure Design
|
| Secure Implementation | - Common Vulnerabilities
|
| Security Verification and Testing | - Testing Techniques
|
>> Secure-Software-Design基礎問題集 <<
あなたはSecure-Software-Design試験に不安を持っていますか？Secure-Software-Design参考資料をご覧下さい。私たちのSecure-Software-Design参考資料は十年以上にわたり、専門家が何度も練習して、作られました。あなたに高品質で、全面的なSecure-Software-Design参考資料を提供することは私たちの責任です。私たちより、Secure-Software-Design試験を知る人はいません。
質問 # 29
Using a web-based common vulnerabilityscoringsystem (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component.The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal andenvironmental metrics.
Which rating would CVSS assign this vulnerability?
正解：B
解説：
The Common Vulnerability Scoring System (CVSS) uses the following ranges to determine the severity rating of a vulnerability:
* 0.1 - 3.9: Low severity
* 4.0 - 6.9: Medium severity
* 7.0 - 8.9: High severity
* 9.0 - 10.0: Critical severity
Since the adjusted score for the vulnerability is 5.9, it falls within theHigh severityrange.
References:
* CVSS v3.1 Specification Document - FIRST: https://www.first.org/cvss/specification-document
* National Vulnerability Database (NVD) - NIST: https://nvd.nist.gov/vuln-metrics/cvss
質問 # 30
A recent vulnerability scan uncovered an XML external entity (XXE) Haw that could allow attackers to return the contents of a system file by including a specificpayloadin an XML request.
How should the organization remediate this vulnerability?
正解：A
解説：
Security change management within the change management process involves ensuring that any changes, including updates or modifications to software, do not introduce new vulnerabilities and are in line with security policies. The question about securing remote administration directly reflects this component because it addresses the security considerations that must be managed when changes are made to how software is accessed and controlled remotely. This includes implementing secure protocols,authentication methods, and monitoring to prevent unauthorized access or breaches, which are crucial when managing changes in a secure manner.
References:
* Change management in cybersecurity emphasizes the structured approach to implementing alterations in security protocols, technologies, and processes, ensuring systematic assessment and monitoring1.
* The role of change management in cybersecurity includes decisions about network access and ensuring the right person can access the right information at the right time, which aligns with securing remote administration2.
* Seminal change management models in cybersecurity, like PROSCI's ADKAR model, guide individuals through the change process, managing resistance and identifying training needs, which is relevant to securing remote administration3.
質問 # 31
In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?
正解：D
解説：
In the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology, vulnerability and exploit analysis is performed during the Attack modeling step. This step involves identifying potential threats and vulnerabilities within the system and understanding how they could be exploited.
* Attack modeling is a critical phase where the focus is on simulating attacks based on identified vulnerabilities. It allows for a deep understanding of the threats in the context of the application's architecture and system design.
* During this phase, security analysts use their knowledge of the system's technical scope and application decomposition to simulate how an attacker could exploit the system's vulnerabilities. This helps in prioritizing the risks and planning appropriate mitigation strategies.
* The goal of attack modeling is not just to identify vulnerabilities but also to understand the potential impact of exploits on the system and the business, which is essential for developing a robust security posture.
References: The information provided is aligned with the PASTA methodology as described in resources such as VerSprite1 and the OWASP Foundation2. These sources detail the seven stages of PASTA, with attack modeling being a key component of the process.
質問 # 32
The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team's quality standards.
Which category of secure software best practices is the team performing?
正解：D
解説：
The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team's quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.
References:
* Fundamental Practices for Secure Software Development - SAFECode1.
* Secure Software Development Framework | CSRC2.
* Secure Software Development Best Practices - Hyperproof3.
質問 # 33
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?
正解：A
解説：
The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization's ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.
References: The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework12345.
質問 # 34
......
IT業の多くの人がいくつか認証試験にパスしたくて、それなりの合格証明書が君に最大な上昇空間を与えます。この競争の激しい業界でとんとん拍子に出世させるのはWGUのSecure-Software-Design認定試験ですが、簡単にパスではありません。でもたくさんの方法があって、最も少ない時間をエネルギーをかかるのは最高です。
Secure-Software-Design的中関連問題: https://www.japancert.com/Secure-Software-Design.html
無料でクラウドストレージから最新のJapancert Secure-Software-Design PDFダンプをダウンロードする：https://drive.google.com/open?id=1DyUmgpD6ANI5LODWzdhxcsEc5-NUvPNx