Which attribute provides a dictionary of breakpoint instances? –
ANSWER- – bplist<\/li>\n\n\n\n
Which function can be used to return all set breakpoints? – ANSWER- –
get_all_breaks( )<\/li>\n\n\n\n
Which three data types are considered user-provided? – ANSWER- –
cookies<\/li>\n\n\n\n
How many arguments does the clear_break() method take? – ANSWER-<\/p>\n\n\n\n
- \n
- Two<\/li>\n\n\n\n
- filename, line number
Which three QA security-specific test type categories must be performed
on software? – ANSWER- – benchmark<\/li>\n\n\n\n - scheduled<\/li>\n\n\n\n
- exploratory
Manual Code Review Process Steps – ANSWER- 1. identify security
code review objectives<\/li>\n<\/ul>\n\n\n\n- \n
- perform preliminary scan<\/li>\n\n\n\n
- review code for security issues<\/li>\n\n\n\n
- review for security issues unique to the architecture
What are limitations of Static Code Analysis? – ANSWER- – does not
account for runtime vulnerabilities<\/li>\n<\/ol>\n\n\n\n- \n
- requires the tester to posses both testing and software development
skills<\/li>\n\n\n\n - tools would have to be language specific
What are advantages of Static Code Analysis? – ANSWER- – fast
turnaround time, especially when tools are used<\/li>\n<\/ul>\n\n\n\nWhat are advantages of Dynamic Code Analysis? – ANSWER- – there is
no need to understand how to write software
What are limitations of Dynamic Code Analysis? – ANSWER- – false
negatives and false positives<\/p>\n\n\n\n- \n
- dependent on the correctness of the rules<\/li>\n\n\n\n
- false sense of security
How should Loggers be instantiated? – ANSWER- – never instantiated
directly<\/li>\n\n\n\n - always through the module-level function<\/li>\n\n\n\n
- logging.getLogger(name)
What Logger method sets the threshold for the logger instance?
How does it work? – ANSWER- – setLevel(level)<\/li>\n\n\n\n - logging messages which are less severe than “level” will be ignored<\/li>\n\n\n\n
- logging messages which have severity “level” or higher will be emitted
by whichever handle or handlers service this logger
Security Logs – ANSWER- – record access to resources such as files,
folders, printers
What standard specifies minimum security requirements for audit data
(logs)? – ANSWER- – NIST FIPS 200<\/li>\n\n\n\n - <\/li>\n<\/ul>\n\n\n\n
Defensive Coding Basic Concepts? – ANSWER- – all data is important<\/p>\n\n\n\n
- \n
- all data is tainted<\/li>\n\n\n\n
- all code is insecure<\/li>\n\n\n\n
- design by contract<\/li>\n\n\n\n
- sanitize (make sure no attack characters)
6 important aspects of OSSTMM? – ANSWER- – Open Source Security
Testing Methodology Manual<\/li>\n<\/ul>\n\n\n\n
- requires the tester to posses both testing and software development
![\"\"](\"https:\/\/learnexams.com\/blog\/wp-content\/uploads\/2024\/03\/Screenshot_144-1024x763.png\")
<\/figure>\n\n\n\n