SOFTDEV midterms

This technique involves examining the source code of a program looking for patterns that are known to cause errors or security vulnerabilities, but it is performed without actually running the software.

In reliability testing, it is crucial to test the software using input patterns that reflect how actual users are expected to behave in a real-world environment. This set of expected behaviors is called the

When a testing tool incorrectly flags a safe piece of code as having a vulnerability, wasting the developer's time investigating a non-existent problem, this result is known as a

This specific type of dynamic testing involves throwing massive amounts of random, malformed, or invalid data at a system to see if it crashes or reveals a security hole.

To assure security, a team may simulate an attack on the system using known hacking techniques to identify weaknesses before malicious actors can exploit them. This is widely known as

This metric represents the probability that a system will fail specifically when a request for service is made, rather than over a period of time.

A structured document that presents arguments and evidence demonstrating that a system is safe to operate in a specific context is called a

Unlike functional testing which checks if features work, this type of analysis focuses purely on how the software behaves under extreme pressure or load to ensure it does not fail catastrophically.

This automated process runs immediately after code changes are committed to ensure that new modifications have not introduced defects into previously working features.

In the context of static analysis, this term refers to the scope of variables and whether a variable is used before it is initialized.

This form of review involves a small group of developers methodically reading through code line-by-line to find logic errors that automated tools might miss.

When measuring reliability, this unit refers to the average amount of time a system functions correctly between observable failures.

A mathematical approach to software verification that uses logic and math to prove that a program conforms to its specification is known as

This security assurance activity involves reviewing the system architecture and design specifically to identify potential threats and the assets that need protection.

This type of error occurs when a static analysis tool fails to identify a real vulnerability that actually exists in the code.

True or False: Static analysis tools are generally more effective than human inspections at finding subtle logic errors where the code is syntactically correct but functionally wrong.

True or False: Testing can successfully prove that a software system is completely free of defects.

True or False: A high level of test coverage (e.g., 100% statement coverage) guarantees that the software is reliable.

True or False: Security testing is fundamentally different from reliability testing because security testing must account for intelligent, malicious inputs rather than just accidental user errors.

True or False: In a safety-critical system, it is acceptable to sacrifice some performance speed to ensure the system fails safely.

True or False: Penetration testing should be performed during the requirements phase of the software development lifecycle (SDLC).

True or False: Reliability growth models assume that when a defect is discovered and fixed, the overall reliability of the system increases.

True or False: Static analysis is limited because it cannot detect errors that depend on the specific timing of interactions between different software components.

True or False: An operational profile is not required for stress testing because the goal is to break the system, not simulate normal usage.

True or False: Safety assurance focuses on protecting the system from external attacks, while security assurance focuses on preventing the system from harming the environment.

True or False: Use of safe programming languages (like Java or Rust) eliminates the need for static analysis regarding memory management errors.

True or False: Formal methods are rarely used in general commercial software development due to the high cost and specialized skills required.

True or False: If a system has been formally verified, it does not require dynamic testing.

True or False: A "safety case" is a legal defense used after an accident occurs, rather than a technical document created during development.

True or False: Automated static analysis is computationally inexpensive and can be run frequently, making it suitable for integration into daily builds.

This phrase refers to a common cultural resistance among developers who refuse to use third-party code because they believe they can write better code themselves or do not trust external quality.

In this specific type of reuse, a generic application structure is provided as a set of abstract classes and interfaces; the developer extends these classes to create a specific system, effectively handing over flow control to the generic structure.

This large-scale reuse strategy involves creating a set of software systems that share a common core architecture and set of reusable components, but are individually customized for specific customers or market segments.

This term describes pre-packaged, complete software systems that can be bought and configured to run without requiring access to their source code (e.g., Microsoft Office, Oracle Database).

Within a software product line, these are the specific locations in the design or code where the core system can be modified or extended to adapt to different requirements.

This reuse approach involves wrapping legacy systems or distinct functional units as accessible endpoints that can be accessed over a network, often using standard protocols like SOAP or REST.

A fundamental benefit of reuse is that recycled code has often been tested across many different systems, leading to a higher level of confirmed

This term refers to the cost associated with searching for, understanding, and modifying a reusable component to fit a new context.

In the context of framework-based development, this design principle dictates that the framework calls the custom code (rather than the custom code calling a library), often described as "Don't call us, we'll call you."

This type of reuse involves integrating huge, stand-alone systems (like an Enterprise Resource Planning system) to support business processes, often requiring significant configuration but little actual coding.

This visual mapping tool helps decision-makers understand the different available reuse approaches, ranging from "System Reuse" to "Component Reuse" to "Object Reuse," and their associated costs.

When a company relies too heavily on a specific COTS product, they face this risk where the vendor might discontinue support, increase prices, or go out of business, leaving the company with no control.

This specific layer in a reuse-oriented architecture acts as the glue code that converts data and calls between the reusable components and the specific application requirements.

This method of reuse involves reusing abstract algorithms or designs rather than actual code, often codified as solutions to common problems (e.g., Observer, Singleton).

In a product line architecture, this term refers to the shared set of software assets (code, documentation, designs) that are used across all members of the product family.

True or False: Developing a software product line is initially more expensive than developing a single standalone system.

True or False: Application frameworks are generally easier to learn than simple class libraries because they enforce a standard structure.

True or False: The "Not Invented Here" syndrome is purely a technical problem related to incompatible code interfaces.

True or False: Reusing software always increases the overall development speed, even if the team is unfamiliar with the reusable components.

True or False: In a "White-box" framework, the developer customizes behavior by subclassing and overriding methods, requiring access to the framework's source code logic.

True or False: COTS solution systems generally offer the highest flexibility because the source code is available for modification.

True or False: One of the main arguments for software reuse is the effective use of specialists; a security expert can write a module once, and non-experts can safely use it.

True or False: System adaptation (modifying code to fit) is rarely required when using COTS systems.

True or False: Software reuse eliminates the need for system testing since the components have already been tested.

True or False: Adaptation of a software product line can include both selecting modules to include and adding new, unique modules.

True or False: "Inversion of Control" is a defining characteristic that distinguishes libraries from frameworks.

True or False: Component-level reuse is generally easier to implement than Concept-level reuse (Design Patterns) because components are executable binaries.

True or False: If a COTS product contains a bug, the integrating company usually has the legal right and technical ability to fix the source code immediately.

True or False: The "Reuse Landscape" suggests that as you move from small-scale (objects) to large-scale (systems), the cost of adaptation generally decreases.

True or False: A major risk of COTS reuse is that the evolution of the system is dictated by the vendor's upgrade schedule, not the user's business needs.

This entity is an independent software unit that can be deployed without compiling other parts of the system, often treated as a binary "black box" by the user.

In a component definition, this specific part of the contract defines the services that the component must receive from other components in order to function correctly.

This infrastructure software (such as EJB, COM+, or .NET) provides the standard environment and services (like transaction management and security) that allow components to communicate.

When two components have incompatible interfaces, this specialized piece of code is written to convert the calls and data from one format to another, bridging the gap.

This specific type of interface definition specifies the services that a component offers to other components in the system.

This rigorous standard definition (e.g., CORBA, JavaBeans) prescribes how components are implemented, how they document their interfaces, and how they interact with the infrastructure.

In this type of composition, two components are executed in an alternating sequence, where the output of the first component becomes the input for the second.

This development process focuses on creating reusable software units specifically designed to be general-purpose and adhering to a standard model, rather than solving a specific application problem.

This issue arises when a component's internal operation is hidden, making it difficult for the integrator to know if the component will perform efficiently or reliably in a new environment.

This type of composition occurs when one component calls the services of another component directly, establishing a parent-child relationship in the control flow.

Unlike Object-Oriented programming where classes are source-code level entities, components are typically distributed as

This specific incompatibility issue occurs when the calling component provides data in units (e.g., inches) that differ from what the receiving component expects (e.g., centimeters).

In the CBSE lifecycle, this phase involves searching databases or libraries to identify existing components that match the system requirements.

This composition issue occurs when a component requires a specific parameter (like a security token) that the calling component does not possess or provide.

This term refers to the process of wiring or integrating components together to create a functional system or a larger aggregate component.

True or False: In Component-Based Software Engineering, the system requirements are typically finalized before any components are selected to ensure the system meets user needs exactly.

True or False: A key distinction between a Class and a Component is that a Component is an independent deployment unit, whereas a Class must be compiled into a program.

True or False: "Glue code" is used to optimize the performance of two compatible components by bypassing the standard interface.

True or False: The "Requires Interface" of a component allows the system architect to know which external services must be present for the component to operate.

True or False: Component-Based Software Engineering eliminates the need for system testing because the individual components are already pre-tested by their vendors.

True or False: Parameter incompatibility occurs when the number of parameters in a method call matches, but the data types or semantic meanings do not align.

True or False: Development with reuse (building an app) follows the same V-model process as Development for reuse (building a component).

True or False: Middleware is optional in CBSE; components can easily communicate directly with each other across different operating systems without it.

True or False: Hierarchical composition implies that a new component is created by wrapping one or more existing components, effectively hiding them from the external system.

True or False: One of the major risks in CBSE is the lack of control over the evolution and maintenance of third-party components.

True or False: In a sequential composition, the components execute concurrently and share a common database state.

True or False: Finding suitable components is often the most time-consuming phase of the CBSE process due to poor indexing and vague documentation.

True or False: If a component's source code is unavailable, it is impossible to write an adaptor to fix interface incompatibilities.

True or False: A "Provided Interface" defines the services that the component expects the environment to supply.

True or False: Trustworthiness is a significant concern in CBSE because the integrator cannot formally verify the internal logic of a black-box component.

This property of distributed systems describes their ability to continue operating correctly even when some components of the system fail or go offline.

A specific type of architecture where the system is organized into layers, and each layer provides services to the layer immediately above it, often used to separate presentation, logic, and data.

Software that sits between the operating system and the distributed applications, managing communication and data transfer so that the distribution is transparent to the user.

In this architectural model, a set of identical processes run on different processors to share the workload, improving performance and reliability.

This term refers to the ability of a system to handle an increasing amount of work or to be readily enlarged to accommodate that growth without changing the system architecture.

A distributed system interaction model where one component initiates a request for a service and waits for a response from another component that provides the service.

The specific risk in distributed systems where an unauthorized entity intercepts and potentially alters communication between two valid components.

This architectural pattern involves multiple clients accessing a shared database or file system directly, without an intervening server to manage the logic.

In a client-server architecture, this term describes a client that handles not just the user interface but also a significant portion of the application processing logic.

This type of attack seeks to make a distributed system unavailable to its intended users by overwhelming it with a flood of illegitimate requests.

A distributed application design where the user interface runs on the user's computer, but all application processing and data management occur on a remote server.

The characteristic of a distributed system that allows it to effectively hide the fact that resources and processes are physically separated across a network.

In this specific peer-to-peer (P2P) architecture, there is no central server to index files; instead, the network relies on a decentralized discovery mechanism.

This communication standard allows objects written in different programming languages and running on different platforms to interact seamlessly.

A distributed system configuration where resources (like printers or files) are managed by specific servers, and users access these resources through their workstations.

True or False: Distributed systems generally offer better resource sharing than centralized systems because users can access hardware and software resources located on other computers.

True or False: A "Thin Client" architecture is typically more difficult to manage than a "Fat Client" architecture because software updates must be installed on every individual user machine.

True or False: Scalability in distributed systems can be achieved by adding more resources (horizontal scaling) rather than just upgrading the central hardware (vertical scaling).

True or False: Middleware is strictly defined as the hardware components (routers and switches) that physically connect distributed computers.

True or False: In a Master-Slave architecture, if the Master node fails, the system can usually continue to function automatically without interruption by electing a new Master immediately.

True or False: One major disadvantage of distributed systems is that they are inherently more complex to secure than centralized systems due to the multiple points of access.

True or False: Peer-to-Peer (P2P) systems are distinguished by the clear separation of roles where one node always requests services and the other always provides them.

True or False: The "Openness" of a distributed system refers to the extent to which the system can be extended and re-implemented in various ways.

True or False: In a multi-tier client-server architecture, the database server handles the presentation logic to ensure data is displayed correctly to the user.

True or False: Distributed object architectures allow objects to be distributed across a network, but they must all be written in the same programming language to communicate.

True or False: A Denial of Service (DoS) attack is a reliability issue but not strictly a security issue since no data is stolen.

True or False: "Transparency" in a distributed system means that the user is explicitly made aware of which server is processing their request to ensure trust.

True or False: Three-tier client-server architectures are generally more scalable than two-tier architectures because the application processing load can be distributed separately from the data management.

True or False: The primary benefit of a distributed system is that it eliminates the need for network communication, as all data is stored locally.

True or False: In a distributed system, failure is often partial; the system may continue to provide some services even if parts of it have crashed.

In this specific software delivery model, a single instance of the software runs on a server and serves multiple distinct customer organizations simultaneously.

This financial term describes the shift in cost structure where software is paid for via a recurring subscription rather than a large upfront purchase of a permanent license.

Because SaaS users cannot modify the source code, this mechanism is provided to allow them to adapt the software's behavior to their specific business needs.

This legal contract between the cloud provider and the customer specifies the guaranteed performance metrics, such as uptime percentage and response time latency.

This risk refers to the difficulty a customer faces when trying to migrate their data and business processes away from a specific cloud provider to a competitor.

This underlying technology allows a single physical server to simulate multiple independent computing environments, forming the foundation of modern cloud resource allocation.

Unlike the ASP model, modern SaaS relies on this database design strategy where customer data is separated logically but stored physically in shared tables.

This characteristic of cloud computing refers to the ability of the system to automatically increase or decrease allocated resources based on the current traffic demand.

In SaaS architecture, the software is typically accessed through this universal client interface, eliminating the need for specialized client software installation.

This term describes the delay introduced by transmitting data over the network between the user's client and the cloud server.

This specific category of cloud service offers a platform allowing developers to build and deploy applications without managing the underlying operating systems.

To maintain data security in a shared environment, SaaS architects must ensure rigorous separation of records, preventing one tenant from accessing another's.

This type of software update mechanism ensures that all users are immediately and simultaneously using the latest version of the application without manual patching.

A cloud deployment model where the infrastructure is provisioned for open use by the general public and exists on the premises of the cloud provider.

This design principle suggests that web server components in a cloud architecture should not retain user session data locally.

True or False: In a true multi-tenant SaaS architecture, the provider maintains a separate source code branch for each major customer to accommodate their specific feature requests.

True or False: One of the primary benefits of SaaS for the software vendor is the ability to continuously deploy bug fixes to all customers instantly.

True or False: Data transfer speed (bandwidth) is rarely a limiting factor in SaaS design because modern internet connections are universally fast.

True or False: Customization in SaaS is achieved by writing new code modules that are linked to the core application, similar to writing a plugin for a desktop app.

True or False: Service Level Agreements (SLAs) typically place the liability for data loss entirely on the user, absolving the provider of all responsibility.

True or False: SaaS applications generally require less local processing power on the client machine compared to traditional installed software.

True or False: For a SaaS provider, the cost of supporting users typically increases linearly with the number of users, just like in the traditional shrink-wrapped software model.

True or False: Security is often cited as a major barrier to SaaS adoption because the organization loses physical control over where its data is stored.

True or False: Scalability in the cloud is achieved primarily by "vertical scaling" rather than "horizontal scaling."

True or False: A "Stateless" architecture is preferred for SaaS because it allows the system to easily route user requests to any available server in the cluster.

True or False: In the SaaS model, the software is treated as a capital asset (CapEx) that depreciates over time on the company's balance sheet.

True or False: Configuration of a SaaS application usually involves setting parameters in a database that determine how the generic software code behaves for a specific tenant.

True or False: Latency is more critical in transactional SaaS applications (like text editing) than in batch-processing applications (like payroll generation).

True or False: Local regulations regarding data privacy (such as GDPR) are irrelevant in Cloud Computing because the internet has no borders.

True or False: The "Application Service Provider" (ASP) model of the late 1990s is identical to modern SaaS, with the only difference being faster internet speeds.