An in-house development team in your organization is tasked to develop a new information system deployed to a public PaaS to support a new mission. A well-known consulting firm, enlisted in your organizational approved providers and offerings, is contracted to advise cloud services. Some of the tools used by developers are freeware downloaded from the internet. Which of the following acquisition sources is not used in this project?
A. Commercial-off-the-shelf (COTS)
B. Open Source
C. Managed services
D. Third-party

Continue reading →

Software-defined networking (SDN) abstracts the control over the flow of data by separating logical control rules from physical data forwarding into the control plane and the data plane. Logical control rules are programmable as software, while sophisticated data-plane functionality is virtualizable through Network function virtualization (NFV). Software-defined security (SDS) is a security model that exploits SDN/NFV to enforce network security by security software on generic servers abstracting security appliances, such as Firewall, IDS, etc. Which of the following is not true about SDN, NFV, or SDS?
A. Controllers can impose flow rules or policies on physical devices via OpenFlow.
B. Switches at the data-plane implement the spanning-tree algorithm to prevent loops.
C. Software switches through NFV can be implemented independently without SDN.
D. Firewalls on generic servers as SDN applications can communicate with controllers through APIs.

Continue reading →

Your company is developing a mobile app with the support of the RESTful backend API gateway which receives articles from the mobile app and posts them across social media on behalf of the author. The API gateway creates copies in the database server so that authors can manage them. As an architect, you are designing the system architecture. Which of the following is the most feasible design decision?
A. The mobile app shall invoke API through HTTP POST to create and share articles.
B. IP whitelisting on the API gateway shall be enabled to enforce the authenticity of origin.
C. Rate limits, such as throttling and quotas, shall be applied to prevent the race condition.
D. SAML shall be implemented for authentication.

Continue reading →

In the context of software, the runtime is an umbrella term that may refer to the runtime environment, runtime library, or the runtime phase in the program lifecycle. Which of the following is least related to the concept of runtime?
A. A web browser
B. A software component packaged in a DLL file
C. A cryptographic library linked by a linker
D. A process that hosts other dynamic components

Continue reading →

According to Gartner, cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed. Which of the following is the least common CASB implementation?
A. Install a server that acts as an intermediary for requests from clients.
B. Install a server that retrieves resources on behalf of a client from one or more servers.
C. Install a server that accepts requests to establish a VPN connection from clients.
D. Install a  server that provides direct, secure access to cloud applications through API.

Continue reading →

The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. Which of the following is not true?
A. SAMM defines five maturity levels as objectives.
B. SAMM supports the complete software lifecycle.
C. SAMM is a prescriptive model that is technology and process agnostic.
D. SAMM categorizes software development activities into five critical business functions.

Continue reading →