Network and system access controls can’t also be layered.

a.

True

b.

False

Quality of Service (QoS) with Internet-based VPNs is not an issue that should be considered.

a.

False

b.

True

Every application must be secure enough to protect itself from whatever meaningful attacks the deployment environment cannot prevent for long enough.

a.

False

b.

True

Responsibilities should be identified in the risk management plan, which includes the project manager.

a.

False

b.

True

Every security design includes certain assumptions about what is trusted and what is not trusted, and who can go where.

a.

True

b.

False

Application security needs not to be done right from the start because it’s much easier to actively fix security problems in the field than it is to do so in the programmer’s chair.

a.

True

b.

False