Questions

1. Does OWASP SAMM stand for Software Assurance Maturity Model?
2. Which of the following are defined in OWASP security governance?
   1. Strategy and metrics
   2. Policy and compliance
   3. Education and guidance
   4. All of the above
3. According to OWASP SAMM, what should be considered during the construction phase?
   1. Security architecture
   2. Threat assessment
   3. Security requirements
   4. All of the above
4. Which of the following is not a tool or technique for threat modeling?
   1. CAPEC
   2. ATT&CK
   3. OWASP Cornucopia
   4. GDPR
5. In GDPR, what security practices may we apply to do a privacy assessment?
   1. PIA Privacy Impact Analysis
   2. Penetration testing
   3. Issue Management
   4. ISO 27001