Software Security Assessment: Core Concepts and Practical Challenges

1. Software consists of programs, (_____) and (_____).

Answer: documentation, data

2. In network attacks, over (_____%) of vulnerabilities originate from application software.

Answer: 70

3. The percentage of mobile apps with security vulnerabilities exceeds (_____%).

Answer: 90

4. Software security threats are categorized into three types: (_____), (_____), and (_____).

Answer: software vulnerabilities, malicious code, software infringement

5. The vulnerability exploitation process includes: vulnerability discovery, (_____), (_____), vulnerability exploitation, and attack execution.

Answer: vulnerability analysis, vulnerability confirmation

6. True or False: A zero-day vulnerability refers to a flaw discovered immeidately after software release.

Answer: False

7. Does the following C/C++ function contain security vulnerabilities?

long calculate_product(int value1, int value2) {
    long result = value1 * value2;
    return result;
}

Answer: Yes (potential integer overflow)

8. Does the following Java function contain security vulnerabilities?

long compute_multiplication(int num1, int num2) {
    long output = num1 * num2;
    return output;
}

Answer: Yes (potential integer overflow)

9. What is the output of the following code?

int value = -3;
unsigned short u_value = value;
printf("%u", u_value);

Answer: 65533

10. What is the result of the following code?

char letter_a = 'a';
char letter_b = 'b';
char combined = letter_a + letter_b;
printf("%d,", combined);

Answer: -61

11. How would you modify the previous code to achieve the intended result?

Answer: int combined = letter_a + letter_b;

1. Software security errors generally encompass six aspects: (_____), (_____), (_____), (_____), (_____), and (_____).

Answer: requirement errors, design errors, coding errors, testing errors, configuration errors, documentation errors

2. (_____) is the root cause of information security incidents.

Answer: Vulnerabilities

3. A vulnerability where a patch is available but not yet applied by users is called a (_____) vulnerability.

Answer: one-day

4. In software dveelopment: human errors are called (_____), internal software errors are called (_____), and abnormal runtime states are called (_____).

Answer: software error, software defect, software fault

5. Cyberspace includes electronic devices, infrastructure, applications, data, and (_____).

Answer: people

6. In the PDRR security framework model, P stands for (_____) and D stands for (_____).

Answer: Protection, Detection

7. True or False: A zero-day vulnerability refers to an undisclosed vulnerability.

Answer: False

8. True or False: A vulnerability discovered immediately after software release is called a 0-day vulnerability.

Answer: False

1. A stack frame is a memory space allocated by the system for each (_____) call in a process.

Answer: function

2. The pointer to the current stack frame's top is (_____), while the pointer to the bottom is (_____).

Answer: ESP, EBP

3. Buffer overflow occurs when writing data to a buffer without (_____) checking, causing data to exceed the pre-allocated (_____) and overwrite legitimate data.

Answer: boundary, boundary

4. The data segment stores (_____) variables and (_____) variables.

Answer: global, static

5. Stack grows from (_____) addresses to (_____) addresses; heap grows from (_____) addresses to (_____) addresses.

Answer: high, low, low, high

6. In Win32 systems, process memory is divided into 4 regions from low to high addresses: (_____), (_____), (_____), and (_____).

Answer: stack, heap, code, data

7. True or False: Program buffers can be located in heap, stack, or data segments.

Answer: True

8. True or False: The code segment only contains machine code.

Answer: False

9. Fix the boundary checking errors in lines 1 and 6:

char source[5];
char target[] = "abcde";
char *buffer;
int index;
strcpy(source, target);
buffer = (char *) malloc(strlen(source));

Answer: char source[6]; buffer = (char*)malloc(strlen(source)+1);

10. Add input length control before the cin statement:

char input_buffer[10];
cin >> input_buffer;
cout << input_buffer << endl;

Answer: cin.width(10)

11. Does this code have an error? If yes, correct it:

char *text = "c language";
text[0] = 'C';

Answer: Yes, char text[] = "c language";

12. C format specifiers: width-6 right-aligned decimal (_____); width-6 zero-padded decimal (_____); hexadecimal (_____); string (_____); float (_____); unsigned decimal (_____); character (_____); exponential float (_____); pointer (_____); long integer (_____).

Answer: %6d, %06d, %x, %s, %f, %u, %c, %e, %p, %ld

1. The software lifecycle consists of three periods: (_____), (_____), and (_____).

Answer: software definition, software development, software maintenance

2. The period that determines the overall software objectives is (_____), handled by (_____).

Answer: software definition, system analyst

3. The software definition period includes three phases: (_____), (_____), and (_____).

Answer: problem definition, feasibility study, requirements analysis

4. The period that completes design and implementation is (_____), including system design phases (_____) and (_____), and implementation phases (_____) and (_____).

Answer: software development, overall design, detailed design, coding and unit testing, integration testing

5. The phase that ensures software meets long-term user needs is (_____).

Answer: software maintenance

1. Threat modeling helps identify security issues and risks during software (_____) phase.

Answer: design

2. What is the fundamental approach to addressing software product security?

Answer: Secure by design

3. Software security testing and development include: security (_____), security (_____), security (_____), security (_____), and security (_____).

Answer: requirements analysis, design, coding, testing, deployment

4. Three types of threat modeling are centered on: (_____), (_____), and (_____).

Answer: software, security, assets and risks

5. Testers use (_____) to generate security test cases.

Answer: threat models

6. Development teams use (_____) to implement security controls and write secure code.

Answer: threat models

7. Threat modeling spans the software lifecycle, serving as input for (_____), (_____), (_____), (_____), and operations teams.

Answer: design, development, testing, deployment

8. During design phase, (_____) identifies threats and establishes threat models.

Answer: software architecture team

9. True or False: Threat modeling is an iterative process.

Answer: True

10. True or False: All possible threats are discovered during software development.

Answer: False

Tags: software-security vulnerability-assessment threat-modeling buffer-overflow secure-coding

Posted on Fri, 14 Aug 2026 16:07:06 +0000 by Jessup