QUESTION: 129

The Web resource collection is a security constraint element summarized in the Java Servlet Specification v2.4. Which of the following elements does it include? Each correct answer represents a complete solution. Choose two.

HTTP methods
Role names
Transport guarantees
URL patterns

Answer(s): A,D

Explanation:

Web resource collection is a set of URL patterns and HTTP operations that define all resources required to be protected. It is a security constraint element summarized in the Java Servlet Specification v2.4. The Web resource collection includes the following elements: URL patterns HTTP methods Answer B is incorrect. An authorization constraint includes role names. Answer C is incorrect. A user data constraint includes transport guarantees.

Reveal Solution Next Question

QUESTION: 130

Which of the following activities are performed by the 'Do' cycle component of PDCA (plan-do-check-act)? Each correct answer represents a complete solution. Choose all that apply.

It detects and responds to incidents properly.
It determines controls and their objectives.
It manages resources that are required to achieve a goal.
It performs security awareness training.
It operates the selected controls.

Answer(s): A,C,D,E

Explanation:

The 'Do' cycle component performs the following activities: It operates the selected controls. It detects and responds to incidents properly. It performs security awareness training. It manages resources that are required to achieve a goal. Answer B is incorrect. This activity is performed by the 'Plan' cycle component of PDCA.

Reveal Solution Next Question

QUESTION: 131

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the international information security standards? Each correct answer represents a complete solution. Choose all that apply.

AU audit and accountability
Human resources security
Organization of information security
Risk assessment and treatment

Answer(s): B,C,D

Explanation:

Following are the various international information security standards:
Risk assessment and treatment: Analysis of the organization's information security risks Security policy: Management direction Organization of information security: Governance of information security Asset management: Inventory and classification of information assets Human resources security: Security aspects for employees joining, moving, and leaving an organization Physical and environmental security: Protection of the computer facilities Communications and operations management: Management of technical security controls in systems and networks Access control: Restriction of access rights to networks, systems, applications, functions, and data Information systems acquisition, development and maintenance: Building security into applications Information security incident management: Anticipating and responding appropriately to information security breaches Business continuity management: Protecting, maintaining, and recovering business-critical processes and systems Compliance: Ensuring conformance with information security policies, standards, laws, and regulations Answer A is incorrect. AU audit and accountability is a U.S. Federal Government information security standard.

Reveal Solution Next Question

QUESTION: 132

The Data and Analysis Center for Software (DACS) specifies three general principles for software assurance which work as a framework in order to categorize various secure design principles. Which of the following principles and practices does the General Principle 1 include? Each correct answer represents a complete solution. Choose two.

Principle of separation of privileges, duties, and roles
Assume environment data is not trustworthy
Simplify the design
Principle of least privilege

Answer(s): A,D

Explanation:

General Principle 1- Minimize the number of high-consequence targets includes the following principles and practices:
Principle of least privilege Principle of separation of privileges, duties, and roles Principle of separation of domains Answer B is incorrect. Assume environment data is not trustworthy principle is included in the General Principle 2. Answer C is incorrect. Simplify the design principle is included in the General Principle 3.

Reveal Solution Next Question

Free CSSLP Exam Braindumps (page: 32)

QUESTION: 129

Explanation:

QUESTION: 130

Explanation:

QUESTION: 131

Explanation:

QUESTION: 132

Explanation: