A quality plan is an essential element of all projects. It is critical that the contracted supplier be required to produce such a plan. The quality plan for the proposed development contract should be comprehensive and encompass all phases of the development and include which business functions will be included and when. Acceptance is normally managed by the user area, since they must be satisfied that the new system will meet their requirements. If the system is large, a phased-in approach to implementing the application is a reasonable approach. Prototyping is a valid method of ensuring that the system will meet business requirements.

Section: Protection of Information Assets

Section: Governance and Management of IT

Section: Protection of Information Assets
Explanation/Reference:
Secure Electronic Transaction(SET) is a protocol developed jointly by VISA and Master Card to secure
payment transaction among all parties involved in credit card transactions among all parties involved in
credit card transactions on behalf of cardholders and merchants. As an open system specification, SET is
an application-oriented protocol that uses trusted third party's encryption and digital-signature process, via
PKI infrastructure of trusted third party institutions, to address confidentiality of information, integrity of data,
cardholders authentication, merchant authentication and interoperability.
The following were incorrect answers:
S/MIME - Secure Multipurpose Internet Mail Extension (S/MIME) is a standard secure email protocol that
authenticates the identity of the sender and receiver, verifies message integrity, and ensures the privacy of
message's content's, including attachments.
SSH -A client server program that opens a secure, encrypted command-line shell session from the
Internet for remote logon. Similar to a VPN, SSH uses strong cryptography to protect data, including
password, binary files and administrative commands, transmitted between system on a network. SSH is
typically implemented between two parties by validating each other's credential via digital certificates. SSH
is useful in securing Telnet and FTP services, and is implemented at the application layer, as opposed to
operating at network layer (IPSec Implementation)
Secure Hypertext Transfer Protocol (S/HTTP) -As an application layer protocol, S/HTTP transmits
individual messages or pages securely between a web client and server by establishing SSL-type
connection. Using the https:// designation in the URL, instead of the standard http://, directs the message to
a secure port number rather than the default web port address. This protocol utilizes SSL secure features
but does so as a message rather than the session-oriented protocol.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 352 and 353

Explanation/Reference:
Blind Testing refers to the condition of testing when the penetration tester is provided with limited or no knowledge of the target. Such a testing is expensive, since the penetration tester has to research the target and profile it based on publicly available information.
For your exam you should know below mentioned penetration types
External Testing -Refers to attack and control circumvention attempts on a target's network perimeter from outside the target's system is usually the Internet
Internal Testing - Refers to attack and control circumvention attempt on target from within the perimeter.
The objective is to identify what would occur if the external perimeter was successfully compromised and/ or an authorized user from within the network wanted to compromise security of a specific resource on a network.
Blind Testing -Refers to the condition of testing when the penetration tester is provided with limited or no knowledge of the target's information systems. Such a testing is expensive, since penetration tester have to research the target and profile it based on publicly available information.
Double Blind Testing -It is an extension of blind testing, since the administrator and security staff at the target are also not aware of test. Such a testing can effectively evaluate the incident handling and response capability of the target.
Targeted Testing - Refers to attack and control circumvention attempts on the target, while both the target's IT team and penetration tester are aware of the testing activities. Penetration testers are provided with information related to target and network design. Additionally, they are also provided with a limited privilege user account to be used as a starting point to identify privilege escalation possibilities in the system.
The following were incorrect answers:
External Testing -Refers to attack and control circumvention attempts on a target's network perimeter from outside the target's system is usually the Internet
Internal Testing - Refers to attack and control circumvention attempt on target from within the perimeter.
The objective is to identify what would occur if the external perimeter was successfully compromised and/ or an authorized user from within the network wanted to compromise security of a specific resource on a network.
Targeted Testing - Refers to attack and control circumvention attempts on the target, while both the target's IT team and penetration tester are aware of the testing activities. Penetration testers are provided with information related to target and network design. Additionally, they are also provided with a limited privilege user account to be used as a starting point to identify privilege escalation possibilities in the system.
The Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 369