NO.143 The NIST ITL Cloud Research Team defines some primary and secondary technologies as the fundamental elements of cloud computing in its “Effectively and Securely Using the Cloud Computing Paradigm” presentation. Which of the following technologies are included in the primary technologies? Each correct answer represents a complete solution. Choose all that apply.

NO.144 John works as a systems engineer for BlueWell Inc. He has modified the software, and wants to retest the application to ensure that bugs have been fixed or not. Which of the following tests should John use to accomplish the task?

NO.145 “Enhancing the Development Life Cycle to Produce Secure Software” summarizes the tools and practices that are helpful in producing secure software. What are these tools and practices? Each correct answer represents a complete solution. Choose three.

NO.146 You work as a system engineer for BlueWell Inc. You want to verify that the build meets its data requirements, and correctly generates each expected display and report. Which of the following tests will help you to perform the above task?

NO.147 Microsoft software security expert Michael Howard defines some heuristics for determining code review in “A Process for Performing Security Code Reviews”. Which of the following heuristics increase the application’s attack surface? Each correct answer represents a complete solution. Choose all that apply.

NO.148 Which of the following statements describe the main purposes of a Regulatory policy? Each correct answer represents a complete solution. Choose all that apply.

NO.149 You work as a project manager for a company. The company has started a new security software project. The software configuration management will be used throughout the lifecycle of the project. You are tasked to modify the functional features and the basic logic of the software and then make them compatible to the initial design of the project. Which of the following procedures of the configuration management will you follow to accomplish the task?

NO.150 The Data and Analysis Center for Software (DACS) specifies three general principles for software assurance which work as a framework in order to categorize various secure design principles. Which of the following principles and practices does the General Principle 1 include? Each correct answer represents a complete solution. Choose two.

NO.151 Which of the following statements is true about residual risks?

NO.152 DRAG DROP
Drag and drop the appropriate external constructs in front of their respective functions.
Select and Place:

NO.153 Which of the following is a signature-based intrusion detection system (IDS) ?

NO.154 Which of the following disaster recovery tests includes the operations that shut down at the primary site, and are shifted to the recovery site according to the disaster recovery plan?

NO.155 In which of the following phases of the SDLC does the software and other components of the system faithfully incorporate the design specifications and provide proper documentation and training?

NO.156 Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.

NO.157 Which of the following plans is documented and organized for emergency response, backup operations, and recovery maintained by an activity as part of its security program that will ensure the availability of critical resources and facilitates the continuity of operations in an emergency situation?

NO.158 The NIST Information Security and Privacy Advisory Board (ISPAB) paper “Perspectives on Cloud Computing and Standards” specifies potential advantages and disdvantages of virtualization. Which of the following disadvantages does it include? Each correct answer represents a complete solution. Choose all that apply.

NO.159 Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following areas can be exploited in a penetration test? Each correct answer represents a complete solution. Choose all that apply.

NO.160 You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate location. However, budget is an issue.
Which of the following is most appropriate for this client?

NO.161 According to the NIST SAMATE, dynamic analysis tools operate by generating runtime vulnerability scenario using some functions. Which of the following are functions that are used by the dynamic analysis tools and are summarized in the NIST SAMATE? Each correct answer represents a complete solution.
Choose all that apply.

NO.162 In which of the following deployment models of cloud is the cloud infrastructure administered by the organizations or a third party? Each correct answer represents a complete solution. Choose two.

NO.163 Audit trail or audit log is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process or system function. Under which of the following controls does audit control come?

NO.164 The NIST Information Security and Privacy Advisory Board (ISPAB) paper “Perspectives on Cloud Computing and Standards” specifies potential advantages and disdvantages of virtualization. Which of the following disadvantages does it include? Each correct answer represents a complete solution. Choose all that apply.

NO.165 Which of the following are the levels of public or commercial data classification system? Each correct answer represents a complete solution. Choose all that apply.