Review 66 KEO1 practice questions with answer explanations and community insights.
Question 1
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives. Which BSIMM domain is being assessed?
Governance
Software security development life cycle (SSDL) touchpoints
Intelligence
Deployment
Question 2
Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the user authentication component of the company’s new product. The basso score of the vulnerability was 8.3 and changed to 9.4 after adjusting temporal and environmental metrics. Which rating would CVSS assign this vulnerability?
High severity
Critical severity
Medium severity
Low severity
Question 3
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SQL query to pull information about all accounts from the database: SELECT * FROM accounts WHERE accountID=’ “ ‘ or ‘1’=’1’; Which technique should be used to detect this vulnerability without running the source codes?
Dynamic analysis
Cross-site scripting
Static analysis
Fuzz testing
Question 4
Company leadership has contracted with a security firm to evaluate the vulnerability of all externally facing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
Property-based-testing
Source-code analysis
Penetration testing
Source-code fault injection
Question 5
Which secure coding practice involves clearing all local storage as soon as a user logs off for the night and will automatically log a user out after an hour of inactivity?