CISAW Secure Software case studies
CISAW Secure Software · Put your knowledge to work in context.
This independent study page provides practice for CISAW Secure Software. Its editorial learning areas include Security foundations, governance and Chinese context; Identity, access and cryptographic protection; Application and data protection; Secure development, review and software supply chain; Vulnerability discovery, prioritization and verification; Security operations, monitoring and response; Cyber-risk identification and analysis. The questions develop subject knowledge and application through worked reasoning, distinctions between competing answers, and practical scenarios. Study the relevant guide before attempting a mixed set, then explain the evidence or calculation that supports each answer. The CISAW Secure Software case studies are 4 cases and about 869 words.
1SaaS access after a role change
A fictional organization uses a managed collaboration service for internal planning documents. The provider maintains the application and underlying servers, while the organization configures users, groups and sharing settings.
221 words, about 1 min2A pipeline that protects the artifact and the secret
A fictional team builds a release candidate, tests it and then rebuilds from the same source branch during production deployment. Its dependency ranges are not locked, so the second build can obtain different packages.
223 words, about 1 min3An incident review with an action that can be checked
A fictional delivery team restores service after a release encounters an undocumented database dependency. The initial meeting ends with the statement that the engineer should be more careful, but no owner, test or review date is recorded.
219 words, about 1 min4A control comparison with explicit effectiveness and uncertainty
A fictional organization estimates the value exposed by one defined incident scenario at five hundred thousand currency units and the fraction lost in one successful incident at forty percent. Its classroom model estimates an annualized incident rate of one half, and the exercise asks for expected annual loss rather than a prediction that exactly half an incident occurs each year.
206 words, about 1 min