1. Software consists of programs, (_____) and (_____).
Answer: documentation, data
2. In network attacks, over (_____%) of vulnerabilities originate from application software.
Answer: 70
3. The percentage of mobile apps with security vulnerabilities exceeds (_____%).
Answer: 90
4. Software security threats are categorized into three types: (_____), (_____), and (_____).
Answer: software vulnerabilities, malicious code, software infringement
5. The vulnerability exploitation process includes: vulnerability discovery, (_____), (_____), vulnerability exploitation, and attack execution.
Answer: vulnerability analysis, vulnerability confirmation
6. True or False: A zero-day vulnerability refers to a flaw discovered immeidately after software release.
Answer: False
7. Does the following C/C++ function contain security vulnerabilities?
long calculate_product(int value1, int value2) {
long result = value1 * value2;
return result;
}
Answer: Yes (potential integer overflow)
8. Does the following Java function contain security vulnerabilities?
long compute_multiplication(int num1, int num2) {
long output = num1 * num2;
return output;
}
Answer: Yes (potential integer overflow)
9. What is the output of the following code?
int value = -3;
unsigned short u_value = value;
printf("%u", u_value);
Answer: 65533
10. What is the result of the following code?
char letter_a = 'a';
char letter_b = 'b';
char combined = letter_a + letter_b;
printf("%d,", combined);
Answer: -61
11. How would you modify the previous code to achieve the intended result?
Answer: int combined = letter_a + letter_b;
1. Software security errors generally encompass six aspects: (_____), (_____), (_____), (_____), (_____), and (_____).
Answer: requirement errors, design errors, coding errors, testing errors, configuration errors, documentation errors
2. (_____) is the root cause of information security incidents.
Answer: Vulnerabilities
3. A vulnerability where a patch is available but not yet applied by users is called a (_____) vulnerability.
Answer: one-day
4. In software dveelopment: human errors are called (_____), internal software errors are called (_____), and abnormal runtime states are called (_____).
Answer: software error, software defect, software fault
5. Cyberspace includes electronic devices, infrastructure, applications, data, and (_____).
Answer: people
6. In the PDRR security framework model, P stands for (_____) and D stands for (_____).
Answer: Protection, Detection
7. True or False: A zero-day vulnerability refers to an undisclosed vulnerability.
Answer: False
8. True or False: A vulnerability discovered immediately after software release is called a 0-day vulnerability.
Answer: False
1. A stack frame is a memory space allocated by the system for each (_____) call in a process.
Answer: function
2. The pointer to the current stack frame's top is (_____), while the pointer to the bottom is (_____).
Answer: ESP, EBP
3. Buffer overflow occurs when writing data to a buffer without (_____) checking, causing data to exceed the pre-allocated (_____) and overwrite legitimate data.
Answer: boundary, boundary
4. The data segment stores (_____) variables and (_____) variables.
Answer: global, static
5. Stack grows from (_____) addresses to (_____) addresses; heap grows from (_____) addresses to (_____) addresses.
Answer: high, low, low, high
6. In Win32 systems, process memory is divided into 4 regions from low to high addresses: (_____), (_____), (_____), and (_____).
Answer: stack, heap, code, data
7. True or False: Program buffers can be located in heap, stack, or data segments.
Answer: True
8. True or False: The code segment only contains machine code.
Answer: False
9. Fix the boundary checking errors in lines 1 and 6:
char source[5];
char target[] = "abcde";
char *buffer;
int index;
strcpy(source, target);
buffer = (char *) malloc(strlen(source));
Answer: char source[6]; buffer = (char*)malloc(strlen(source)+1);
10. Add input length control before the cin statement:
char input_buffer[10];
cin >> input_buffer;
cout << input_buffer << endl;
Answer: cin.width(10)
11. Does this code have an error? If yes, correct it:
char *text = "c language";
text[0] = 'C';
Answer: Yes, char text[] = "c language";
12. C format specifiers: width-6 right-aligned decimal (_____); width-6 zero-padded decimal (_____); hexadecimal (_____); string (_____); float (_____); unsigned decimal (_____); character (_____); exponential float (_____); pointer (_____); long integer (_____).
Answer: %6d, %06d, %x, %s, %f, %u, %c, %e, %p, %ld
1. The software lifecycle consists of three periods: (_____), (_____), and (_____).
Answer: software definition, software development, software maintenance
2. The period that determines the overall software objectives is (_____), handled by (_____).
Answer: software definition, system analyst
3. The software definition period includes three phases: (_____), (_____), and (_____).
Answer: problem definition, feasibility study, requirements analysis
4. The period that completes design and implementation is (_____), including system design phases (_____) and (_____), and implementation phases (_____) and (_____).
Answer: software development, overall design, detailed design, coding and unit testing, integration testing
5. The phase that ensures software meets long-term user needs is (_____).
Answer: software maintenance
1. Threat modeling helps identify security issues and risks during software (_____) phase.
Answer: design
2. What is the fundamental approach to addressing software product security?
Answer: Secure by design
3. Software security testing and development include: security (_____), security (_____), security (_____), security (_____), and security (_____).
Answer: requirements analysis, design, coding, testing, deployment
4. Three types of threat modeling are centered on: (_____), (_____), and (_____).
Answer: software, security, assets and risks
5. Testers use (_____) to generate security test cases.
Answer: threat models
6. Development teams use (_____) to implement security controls and write secure code.
Answer: threat models
7. Threat modeling spans the software lifecycle, serving as input for (_____), (_____), (_____), (_____), and operations teams.
Answer: design, development, testing, deployment
8. During design phase, (_____) identifies threats and establishes threat models.
Answer: software architecture team
9. True or False: Threat modeling is an iterative process.
Answer: True
10. True or False: All possible threats are discovered during software development.
Answer: False