Which of the following is not a software testing technique that emphasizes using unexpected, malformed, random data as program inputs to crash the program or make it behave unexpectedly?
A. Fuzz testing
B. Synthetic transaction
C. Random testing
D. Monkey testing

An unknown vulnerability is discovered after conducting a vulnerability scanning against your company’s official web site. You are analyzing it and calculating its score based on CVSS v3.1. Which of the following is not a mandatory metric?
A. Attack Vector (AV)
B. Exploit Code Maturity (E)
C. User Interaction (UI)
D. Privileges Required (PR)

You are conducting a vulnerability assessment against your company’s official web site. Which of the following should be scanned first?
A. Known weaknesses in the CWE List
B. Known vulnerabilities in the CVE List
C. Undiscovered or unknown vulnerabilities
D. The attack surface determined after the threat modeling

In a threat modeling meeting, the development team identified a couple of attack vectors. Most of them appear in the OWASP Top 10. Which of the following should be done first to address the attack surface?
A. Prioritize and sort the attack vectors
B. Calculate the risk exposure of each attack vector
C. Submit a change request to revise the architectural design
D. Evaluate and determine the scope of the attack surface to be addressed

A developer using XML-based markup to compose a user interface that will be rendered into an HTML form. Which of the following best describes the programming paradigm?
A. Imperative
B. Declarative
C. Polymorphism
D. Object-oriented

Which of the following software development approaches or practices doesn’t emphasizes engaging customers or end-users in the development process as early as possible?
A. Prototyping
B. Extreme Programming (XP)
C. Integrated Product Team (IPT)
D. Joint Application Development

Which of the following approaches or practices delivers working software to customers least frequently?
A. Scrum
B. Prototyping
C. Minimum viable product (MVP)
D. Dynamic system development method (DSDM)

Your company designs and develops firewalls, which will be evaluated against the highest level of assurance based on the Common Criteria. Which of the following is the best development approach?
A. Scrum
B. Cleanroom
C. Spiral model
D. Minimum viable product (MVP)

Your company is implementing a solution for customer analytics that extracts, transforms, and loads data into the enterprise data warehouse from various information systems that collect and process customer data, subject to change as customers may move to new places and switch to new phones, etc. Which of the following is the best role to enforce data consistency and quality?
A. Data controller
B. Data owner
C. Data steward
D. Data custodian

As a security architect, you are designing security architecture. Which of the following least likely provides you with architectural and design principles?
A. ISO/IEC 19249
B. System Development Life Cycle (SDLC)
C. NIST SP 800-160 Volume 1
D. Saltzer and Schroeder