サンプル問題 1： What are the three primary goals of the secure software development process?
A: Performance, reliability, and maintainability
B: Cost, speed to market, and profitability
C: Redundancy, scalability, and portability
D: Confidentiality, integrity, and availability
正解：D
Explanation: The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC). Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access. Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity. Availability ensures that information and resources are accessible to authorized users when needed. This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions. By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats. Reference: The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3
サンプル問題 2： What refers to the review of software source code by developers other than the original coders to try to identify oversights, mistakes, assumptions, a lack of knowledge, or even experience?
A: User acceptance testing
B: Manual peer review
C: Fault injection
D: Dynamic code review
正解：B
Explanation: Manual peer review refers to the systematic examination of software source code by developers other than the original author. This practice is recognized as a valuable tool for reducing software defects and improving the quality of software projects. It involves developers inspecting the code to find and fix mistakes overlooked in the initial development phase, which enhances both the overall quality of software and the developers’ skills. Peer code review is less formal and more “lightweight” than the code inspections performed in the past, and it provides benefits such as knowledge transfer, increased team awareness, and creation of alternative solutions to problems. Reference: Expectations, Outcomes, and Challenges Of Modern Code Review1 Introduction to Software Engineering/Quality/Code Review2 Software Security during Modern Code Review: The Developer’s Perspective3
サンプル問題 3： Which software-testing technique can be automated or semi-automated and provides invalid, unexpected, or random data to the inputs of a computer software program?
A: Fuzzing
B: Static analysis
C: Dynamic analysis
D: Bugtraq
正解：A
Explanation: Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs. Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols2. Reference: 1: Wikipedia - Fuzzing 2: DZone - Fuzzing in Software Engineering
