50 + Interview Questions in Dependability And Security in Software Engineering Page 1 InterviewSolution

1.	Choose the fault class in which the following automated static analysis check would fall:”Pointer Arithmetic”.(a) Storage management faults(b) Data Faults(c) Input/Output Faults(d) Interface faultsThis question was addressed to me in my homework.I'm obligated to ask this question of Dependability and Security Assurance topic in division Dependability and Security of Software Engineering
Answer» RIGHT CHOICE is (a) Storage MANAGEMENT faults The explanation: None.

Discussion

2.	Which level of Static Analysis allows specific rules that apply to a program to be checked ?(a) Characteristic error checking(b) User-defined error checking(c) Assertion checking(d) All of the mentionedThe question was posed to me during an interview for a job.This key question is from Dependability and Security Assurance in division Dependability and Security of Software Engineering
Answer» The correct choice is (b) User-defined ERROR checking Easy explanation: USERS of a PROGRAMMING language define error PATTERNS, thus extending the TYPES of error that can be detected.

Discussion

3.	Static analysis is now routinely used in the development of many safety and security critical systems.(a) True(b) FalseThe question was posed to me in a job interview.The doubt is from Dependability and Security Assurance topic in division Dependability and Security of Software Engineering
Answer» Correct choice is (a) True To explain: The static analyzer can discover AREAS of VULNERABILITY such as buffer OVERFLOWS or unchecked inputs

Discussion

4.	Choose the fault class in which the following automated static analysis check would fall:”Non-usage of the results of functions”.(a) Storage management faults(b) Data Faults(c) Input/Output Faults(d) Interface faultsThis question was addressed to me in quiz.I'm obligated to ask this question of Dependability and Security Assurance in division Dependability and Security of Software Engineering
Answer» The CORRECT ANSWER is (d) INTERFACE faults Easiest EXPLANATION: NONE.

Discussion

5.	Choose the fault class in which the following automated static analysis check would fall: “Unreachable code”.(a) Control Faults(b) Data Faults(c) Input/Output Faults(d) Interface faultsI have been asked this question during an online exam.The origin of the question is Dependability and Security Assurance in division Dependability and Security of Software Engineering
Answer» RIGHT CHOICE is (a) Control Faults The BEST I can explain: NONE.

Discussion

6.	Choose the fault class in which the following automated static analysis check would fall:”Variables declared but never used”.(a) Control Faults(b) Data Faults(c) Input/Output Faults(d) Interface faultsThe question was posed to me in homework.This key question is from Dependability and Security Assurance in chapter Dependability and Security of Software Engineering
Answer» Right choice is (b) DATA Faults The EXPLANATION: NONE.

Discussion

7.	Select the disadvantage of using Formal methods(a) Concurrent systems can be analysed to discover race conditions that might lead to deadlock(b) Producing a mathematical specification requires a detailed analysis of the requirements(c) They require the use of specialised notations that cannot be understood by domain experts(d) All of the mentionedI got this question in quiz.My doubt stems from Dependability and Security Assurance topic in division Dependability and Security of Software Engineering
Answer» Correct option is (c) They require the USE of specialised notations that cannot be understood by DOMAIN experts Easiest explanation: Formal methods are the ultimate static VERIFICATION technique that may be USED at different STAGES in the development process.

Discussion

8.	Which of the following is incorrect with respect to Model Checking?(a) Model checking is particularly valuable for verifying concurrent systems(b) Model checking is computationally very inexpensive(c) The model checker explores all possible paths through the model(d) All of the mentionedI have been asked this question by my school principal while I was bunking the class.This is a very interesting question from Dependability and Security Assurance in section Dependability and Security of Software Engineering
Answer» The correct choice is (b) MODEL checking is computationally very inexpensive Easiest explanation: Model checking is very expensive.It is only practical to USE it in the VERIFICATION of SMALL to medium sized critical SYSTEMS.

Discussion

9.	Which of the following is a technique covered in Static Analysis ?(a) Formal verification(b) Model checking(c) Automated program analysis(d) All of the mentionedI had been asked this question during an online exam.This question is from Dependability and Security Assurance topic in section Dependability and Security of Software Engineering
Answer» The CORRECT CHOICE is (d) All of the mentioned The BEST EXPLANATION: NONE.

Discussion

10.	Static Analysis involves executing a program.(a) True(b) FalseI have been asked this question by my school principal while I was bunking the class.I'm obligated to ask this question of Dependability and Security Assurance topic in portion Dependability and Security of Software Engineering
Answer» Right CHOICE is (b) False Explanation: Static ANALYSIS techniques are system verification techniques that don’t involve executing a PROGRAM.

Discussion

11.	Circumstances that have potential to cause loss or harm is known as(a) Attack(b) Threat(c) Vulnerability(d) ControlThe question was asked by my school teacher while I was bunking the class.The doubt is from Security Engineering topic in chapter Dependability and Security of Software Engineering
Answer» RIGHT choice is (b) Threat Best EXPLANATION: The ANSWER is SELF EXPLANATORY.

Discussion

12.	The records of each patient that is receiving or has received treatment resembles which security concept ?(a) Asset(b) Threat(c) Vulnerability(d) ControlThis question was addressed to me by my college professor while I was bunking the class.Question is from Security Engineering topic in portion Dependability and Security of Software Engineering
Answer» RIGHT CHOICE is (a) Asset Easy explanation: Asset is a SYSTEM resource that has a VALUE and has to be PROTECTED.

Discussion

13.	A system resource that has a value and has to be protected is known as(a) Asset(b) Control(c) Vulnerability(d) None of the mentionedThis question was posed to me in semester exam.Question is taken from Security Engineering topic in portion Dependability and Security of Software Engineering
Answer» RIGHT ANSWER is (a) Asset To ELABORATE: The answer is SELF EXPLANATORY.

Discussion

14.	An impersonation of an authorised user is an example of a security threat.(a) True(b) FalseThis question was addressed to me in unit test.The origin of the question is Security Engineering topic in section Dependability and Security of Software Engineering
Answer» RIGHT answer is (B) False The BEST explanation: It is a security attack.

Discussion

15.	What is Life cycle risk assessment ?(a) Risk assessment before the system has been deployed(b) Risk assessment while the system is being developed(c) All of the mentioned(d) None of the mentionedThis question was posed to me in homework.My doubt is from Security Engineering topic in chapter Dependability and Security of Software Engineering
Answer» RIGHT OPTION is (C) All of the mentioned Explanation: NONE.

Discussion

16.	Controls that are intended to ensure that attacks are unsuccessful is analogous to ____________ in dependability engineering.(a) Fault avoidance(b) Fault tolerance(c) Fault detection(d) Fault RecoveryThis question was addressed to me in class test.Question is from Security Engineering topic in portion Dependability and Security of Software Engineering
Answer» RIGHT answer is (a) Fault AVOIDANCE To elaborate: In Fault avoidance the system is DEVELOPED in such a way that human ERROR is avoided and thus system FAULTS are minimised.

Discussion

17.	Controls that are intended to repel attacks is analogous to ____________ in dependability engineering.(a) Fault avoidance(b) Fault tolerance(c) Fault detection(d) None of the mentionedThe question was posed to me at a job interview.The above asked question is from Security Engineering in chapter Dependability and Security of Software Engineering
Answer» Right option is (B) Fault tolerance To explain: Here the system is designed so that faults in the DELIVERED software do not result in system FAILURE.

Discussion

18.	What are security controls ?(a) Controls that are intended to ensure that attacks are unsuccessful(b) Controls that are intended to detect and repel attacks(c) Controls that are intended to support recovery from problems(d) All of the mentionedThis question was addressed to me in an online quiz.The doubt is from Security Engineering in chapter Dependability and Security of Software Engineering
Answer» RIGHT choice is (d) All of the mentioned To explain: All the options define a SECURITY control PROPERTY.

Discussion

19.	Security engineering is only concerned with maintenance of systems such that they can resist malicious attacks.(a) True(b) FalseI had been asked this question in an international level competition.This key question is from Security Engineering topic in section Dependability and Security of Software Engineering
Answer» Correct choice is (B) False For explanation: Security ENGINEERING is concerned with maintenance as well as development of such SYSTEMS.

Discussion

20.	Which of the following is a layer of protection for Security ?(a) Platform-level protection(b) Application-level protection(c) Record-level protection(d) All of the mentionedThis question was posed to me in my homework.I'd like to ask this question from Security Engineering in division Dependability and Security of Software Engineering
Answer» The CORRECT ANSWER is (d) All of the mentioned The BEST EXPLANATION: NONE.

Discussion

21.	Which of the following is a bad practice of Dependable programming ?(a) Limit the visibility of information in a program(b) Check array bounds(c) Check all inputs for validity(d) None of the mentionedThe question was posed to me in exam.The doubt is from Dependability Engineering in chapter Dependability and Security of Software Engineering
Answer» The CORRECT answer is (d) None of the mentioned Explanation: All the options are good PRACTICES to achieve DEPENDABILITY Engineering.

Discussion

22.	Exception handling is a mechanism to provide some fault avoidance.(a) True(b) FalseI got this question by my school teacher while I was bunking the class.I would like to ask this question from Dependability Engineering in chapter Dependability and Security of Software Engineering
Answer» The correct CHOICE is (b) False For explanation: Exception handling is a MECHANISM to PROVIDE some FAULT TOLERANCE.

Discussion

23.	What is a Range check?(a) Check that the input does not exceed some maximum size e.g. 40 characters for a name(b) Check that the input falls within a known range(c) Use information about the input to check if it is reasonable rather than an extreme value(d) None of the mentionedThe question was posed to me in a job interview.My question is from Dependability Engineering in portion Dependability and Security of Software Engineering
Answer» Right OPTION is (B) Check that the input falls within a KNOWN range Best explanation: NONE.

Discussion

24.	Which of the following is a Strategy to achieve Software diversity ?(a) Different programming languages(b) Different design methods and tools(c) Explicit specification of different algorithms(d) All of the mentionedThis question was addressed to me in a job interview.My question comes from Dependability Engineering topic in division Dependability and Security of Software Engineering
Answer» CORRECT option is (d) All of the mentioned Best EXPLANATION: Diversity MEANS to provide the same functionality in different ways so that CRITICAL components of a dependable system will not fail in the same way.

Discussion

25.	The use of a well-defined, repeatable process is essential if faults in a system are to be minimized.(a) True(b) FalseThis question was addressed to me in exam.My question is based upon Dependability Engineering topic in section Dependability and Security of Software Engineering
Answer» The CORRECT ANSWER is (a) True The best I can explain: The answer is self explanatory.

Discussion

26.	Which process characteristic with respect to Dependability Engineering is mentioned by the statement: “The process should be understandable by people apart from process participants”?(a) Diverse(b) Documentable(c) Auditable(d) None of the mentionedThe question was posed to me in an interview for internship.This interesting question is from Dependability Engineering topic in division Dependability and Security of Software Engineering
Answer» Right ANSWER is (c) Auditable The explanation is: It means that PROCESS STANDARDS are being followed and make SUGGESTIONS for process IMPROVEMENT.

Discussion

27.	Which of the following is not a Protection system ?(a) System to stop a train if it passes a red light(b) System to indicate not returning of the library book(c) System to shut down a reactor if temperature/pressure are too high(d) None of the mentionedI had been asked this question in an international level competition.I'd like to ask this question from Dependability Engineering in section Dependability and Security of Software Engineering
Answer» The CORRECT choice is (b) System to indicate not returning of the LIBRARY book Explanation: A Protection system is a specialized system that is associated with some other control system, which can TAKE EMERGENCY ACTION if a failure occurs.

Discussion

28.	What is the term for development process organised such that faults in the system are detected and repaired before delivery to the customer ?(a) Fault Avoidance(b) Fault detection(c) Fault tolerance(d) None of the mentionedI got this question in exam.Question is from Dependability Engineering in section Dependability and Security of Software Engineering
Answer» The correct ANSWER is (a) FAULT AVOIDANCE The best I can explain: In Fault Avoidance, the system is developed in such a way that human ERROR is avoided and thus system FAULTS are minimised.

Discussion

29.	What is the term for a system that is designed such that the faults in the delivered software do not result in system failure ?(a) Fault Avoidance(b) Fault detection(c) Fault tolerance(d) None of the mentionedI had been asked this question in an internship interview.This intriguing question originated from Dependability Engineering topic in section Dependability and Security of Software Engineering
Answer» RIGHT ANSWER is (C) FAULT tolerance Explanation: NONE.

Discussion

30.	Which of the following examples does not involve dependability engineering ?(a) Medical Systems(b) Power Systems(c) Library Management(d) TelecommunicationsI had been asked this question during an online exam.The above asked question is from Dependability Engineering in division Dependability and Security of Software Engineering
Answer» Right CHOICE is (c) Library Management Best explanation: Software customers expect all software to be dependable. However, for non-critical APPLICATIONS such as CERTAIN management systems, they may be willing to accept some system failures.

Discussion

31.	To specify security requirements, one should identify the risks that are to be dealt with.(a) True(b) FalseI have been asked this question by my college director while I was bunking the class.My question comes from Dependability and Security Specification topic in section Dependability and Security of Software Engineering
Answer» The correct ANSWER is (B) False Easiest explanation: To specify SECURITY REQUIREMENTS, one should IDENTIFY the assets that are to be dealt with.

Discussion

32.	The aim of preliminary risk analysis and assessment process is to derive security requirements for the system as a whole.(a) True(b) FalseThe question was posed to me during an interview for a job.The above asked question is from Dependability and Security Specification topic in chapter Dependability and Security of Software Engineering
Answer» Correct answer is (a) True Easiest EXPLANATION: In PRELIMINARY RISK analysis stage, decisions on the DETAILED system requirements, the system design, or the IMPLEMENTATION technology have not been made.

Discussion

33.	Which reliability requirements are concerned with maintaining copies of the system?(a) Checking requirements(b) Recovery requirements(c) Redundancy requirements(d) Ambiguous requirementsI had been asked this question by my college professor while I was bunking the class.The doubt is from Dependability and Security Specification in division Dependability and Security of Software Engineering
Answer» RIGHT choice is (b) Recovery requirements Best explanation: These requirements are GEARED to helping the system RECOVER after a FAILURE has OCCURRED.

Discussion

34.	At which stage of risk analysis specification, the additional security requirements take account of the technologies used in building the system and system design and implementation decisions?(a) Preliminary risk analysis(b) Life-cycle risk analysis(c) Operational risk analysis(d) All of the mentionedThis question was posed to me in an online interview.This interesting question is from Dependability and Security Specification in division Dependability and Security of Software Engineering
Answer» The correct choice is (b) LIFE-cycle risk analysis Easy EXPLANATION: This risk assessment takes PLACE during the system development life cycle after design choices have been made..

Discussion

35.	Which reliability metric sets out the probable number of system failures that are likely to be observed relative to a certain time period?(a) POFOD(b) ROCOF(c) AVAIL(d) None of the mentionedI got this question in quiz.This question is from Dependability and Security Specification in chapter Dependability and Security of Software Engineering
Answer» The correct OPTION is (b) ROCOF For EXPLANATION I WOULD say: Rate of OCCURRENCE of failures (ROCOF) sets out the probable number of system failures that are likely to be OBSERVED relative to the number of system executions.

Discussion

36.	Which of the following is not a functional reliability requirement for a system?(a) Checking requirements(b) Recovery requirements(c) Redundancy requirements(d) Ambiguous requirementsThe question was posed to me in an interview.The above asked question is from Dependability and Security Specification topic in portion Dependability and Security of Software Engineering
Answer» The correct CHOICE is (d) Ambiguous requirements To ELABORATE: All the OPTIONS are correct EXCEPT option d.

Discussion

37.	POFOD stands for(a) Possibility of failure ofdata(b) Probability of failure of data(c) Possibility of failure on demand(d) Probability of failure on demandThis question was addressed to me during an interview.This intriguing question originated from Dependability and Security Specification in chapter Dependability and Security of Software Engineering
Answer» Correct OPTION is (d) PROBABILITY of FAILURE on demand The explanation is: NONE.

Discussion

38.	Consider a case where the failure of the system causes damage to the system itself or it data. What type of failure is being described here?(a) Loss of service(b) Incorrect service delivery(c) System/data corruption(d) None of the mentionedI have been asked this question during an interview.Enquiry is from Dependability and Security Specification topic in section Dependability and Security of Software Engineering
Answer» RIGHT CHOICE is (C) System/data corruption For EXPLANATION: NONE.

Discussion

39.	Consider a case where the system is unavailable and cannot deliver its services to users. What type of failure is being described here?(a) Loss of service(b) Incorrect service delivery(c) System/data corruption(d) None of the mentionedI have been asked this question during an internship interview.I'm obligated to ask this question of Dependability and Security Specification topic in portion Dependability and Security of Software Engineering
Answer» Right choice is (a) LOSS of service The explanation is: One may separate this into loss of CRITICAL SERVICES and loss of non-critical services, where the CONSEQUENCES of a failure in non-critical services are LESS than the consequences of critical service failure.

Discussion

40.	How many stages are there in Risk-driven requirements specification?(a) three(b) four(c) five(d) sixThis question was addressed to me in class test.Query is from Dependability and Security Specification topic in section Dependability and Security of Software Engineering
Answer» Correct choice is (B) four Best explanation: These INCLUDE RISK identification, Risk analysis, Risk reduction and Risk decomposition

Discussion

41.	The safety of a system is a system attribute that reflects the system’s ability to operate, normally or abnormally, without injury to people or damage to the environment.(a) True(b) FalseThis question was addressed to me during a job interview.My question is from Dependability and Security in portion Dependability and Security of Software Engineering
Answer» RIGHT ANSWER is (a) True To ELABORATE: NONE.

Discussion

42.	A password checking system that disallows user passwords that are proper names or words that are normally included in a dictionary is an example of ___________ with respect to security systems.(a) risk(b) control(c) attack(d) assetThis question was addressed to me at a job interview.Query is from Dependability and Security in section Dependability and Security of Software Engineering
Answer» Right CHOICE is (b) control The EXPLANATION: A control PROTECTIVE measure that reduces a system’s vulnerability.

Discussion

43.	A weakness in a computer-based system that may be exploited to cause loss or harm is known as?(a) Vulnerability(b) Attack(c) Threat(d) ExposureThis question was addressed to me in an interview.I would like to ask this question from Dependability and Security in division Dependability and Security of Software Engineering
Answer» The CORRECT CHOICE is (a) Vulnerability Easiest EXPLANATION: NONE.

Discussion

44.	which of the following terms is a measure of the probability that the system will cause an accident?(a) Risk(b) Hazard probability(c) Accident(d) DamageI got this question in quiz.This intriguing question comes from Dependability and Security topic in chapter Dependability and Security of Software Engineering
Answer» Correct answer is (a) RISK The best I can EXPLAIN: The risk is assessed by considering the hazard PROBABILITY, the hazard severity, and the probability that the hazard will lead to an ACCIDENT.

Discussion

45.	An assessment of the worst possible damage that could result from a particular hazard is known as(a) Risk(b) Hazard probability(c) Hazard severity(d) MishapThe question was asked during an interview.My question is taken from Dependability and Security topic in division Dependability and Security of Software Engineering
Answer» The correct answer is (c) Hazard severity The explanation is: Hazard severity can RANGE from catastrophic, where MANY people are killed, to minor, where only minor damage RESULTS. When an individual DEATH is a possibility, a reasonable assessment of hazard severity is ‘very high’.

Discussion

46.	An aircraft engine normally includes automatic fire extinguishers.What kind of dependability and security issue the example states?(a) Hazard avoidance(b) Damage limitation(c) Hazard detection(d) Hazard detection and removalThe question was asked by my school principal while I was bunking the class.I'm obligated to ask this question of Dependability and Security in portion Dependability and Security of Software Engineering
Answer» Right answer is (b) Damage limitation For EXPLANATION: The system may INCLUDE PROTECTION features that minimize the damage that may RESULT from an ACCIDENT.

Discussion

47.	A chemical plant system may detect excessive pressure and open a relief valve to reduce these pressures before an explosion occurs. What kind of dependability and security issue the example states?(a) Hazard avoidance(b) Damage limitation(c) Hazard detection(d) Hazard detection and removalThis question was posed to me by my school principal while I was bunking the class.My question is taken from Dependability and Security in portion Dependability and Security of Software Engineering
Answer» The CORRECT choice is (d) Hazard detection and removal Explanation: The SYSTEM is DESIGNED so that hazards are DETECTED and removed before they RESULT in an accident.

Discussion

48.	A characteristic of a software system that can lead to a system error is known as?(a) Human error or mistake(b) System fault(c) System error(d) System failureI had been asked this question during a job interview.I need to ask this question from Dependability and Security in portion Dependability and Security of Software Engineering
Answer» CORRECT CHOICE is (b) System fault The best I can EXPLAIN: NONE.

Discussion

49.	An erroneous system state that can lead to system behavior that is unexpected by system users is known as?(a) Human error or mistake(b) System fault(c) System error(d) System failureThe question was asked in semester exam.I want to ask this question from Dependability and Security topic in chapter Dependability and Security of Software Engineering
Answer» RIGHT choice is (C) SYSTEM error Easiest explanation: NONE.

Discussion

50.	An event that occurs at some point in time when the system does not deliver a service as expected by its users is called _____________(a) Human error or mistake(b) System fault(c) System error(d) System failureThe question was asked in unit test.This interesting question is from Dependability and Security topic in division Dependability and Security of Software Engineering
Answer» CORRECT ANSWER is (d) SYSTEM failure To EXPLAIN: NONE.

Discussion

Explore topic-wise InterviewSolutions in .

Static analysis is now routinely used in the development of many safety and security critical systems.(a) True(b) FalseThe question was posed to me in a job interview.The doubt is from Dependability and Security Assurance topic in division Dependability and Security of Software Engineering

Static Analysis involves executing a program.(a) True(b) FalseI have been asked this question by my school principal while I was bunking the class.I'm obligated to ask this question of Dependability and Security Assurance topic in portion Dependability and Security of Software Engineering

Circumstances that have potential to cause loss or harm is known as(a) Attack(b) Threat(c) Vulnerability(d) ControlThe question was asked by my school teacher while I was bunking the class.The doubt is from Security Engineering topic in chapter Dependability and Security of Software Engineering

A system resource that has a value and has to be protected is known as(a) Asset(b) Control(c) Vulnerability(d) None of the mentionedThis question was posed to me in semester exam.Question is taken from Security Engineering topic in portion Dependability and Security of Software Engineering

An impersonation of an authorised user is an example of a security threat.(a) True(b) FalseThis question was addressed to me in unit test.The origin of the question is Security Engineering topic in section Dependability and Security of Software Engineering

Exception handling is a mechanism to provide some fault avoidance.(a) True(b) FalseI got this question by my school teacher while I was bunking the class.I would like to ask this question from Dependability Engineering in chapter Dependability and Security of Software Engineering

The use of a well-defined, repeatable process is essential if faults in a system are to be minimized.(a) True(b) FalseThis question was addressed to me in exam.My question is based upon Dependability Engineering topic in section Dependability and Security of Software Engineering

How many stages are there in Risk-driven requirements specification?(a) three(b) four(c) five(d) sixThis question was addressed to me in class test.Query is from Dependability and Security Specification topic in section Dependability and Security of Software Engineering