Software Development and Management

The ASAP Team specializes in application security and is responsible for reviewing the security elements of project artifacts at each phase gate. The development team creates artifacts but lacks the specialized security expertise to validate security elements. The Project Manager coordinates activities but doesn't perform technical security reviews. Testing teams focus on functional quality.

CWE (Common Weakness Enumeration) provides a unified, measurable set of software weakness types. It's maintained by MITRE and serves as a taxonomy for common software security weaknesses, unlike CVE which catalogs specific instances.

The ASAP (Application Security Assurance Process) framework provides the best results when applied continuously throughout all phases of development. Starting from requirements analysis helps identify security needs early, while continuing through rollout ensures security is maintained. Applying it only during one phase (testing, development, or design) misses opportunities to prevent or catch vulnerabilities earlier.

The three essential steps of patch management are: Acquiring (obtaining the patch), Testing (verifying it doesn't break systems), and Installing (deployment). This sequence ensures patches work correctly before production deployment. Other options miss the critical testing phase or add unnecessary steps like peer review.

The OWB design-time component includes three main tools for metadata creation and publishing: (1) Metadata Repository - stores all design-time metadata about objects and mappings, (2) Metadata Reporting - generates reports on the metadata for documentation and analysis, and (3) Design Editor - provides the main interface for creating and designing warehouse objects and mappings. The Repository Manager is a utility for repository administration, not a metadata creation/publishing tool.

MVC stands for Model-View-Controller, a design pattern that separates application logic into three interconnected components. The Model handles data and business logic, the View manages the UI presentation, and the Controller processes user input and coordinates Model and View interactions.

MVC stands for Model-View-Controller, a design pattern separating application logic into three interconnected components. Model handles data, View handles presentation, and Controller handles user input.

ETL (Extract, Transform, Load) typically consumes 60-70% of a data warehousing project's time and resources. This phase involves extracting data from multiple source systems, transforming it (cleaning, standardizing, calculating), and loading it into the warehouse. The complexity comes from diverse source systems, data quality issues, business logic implementation, and ongoing maintenance. Requirements gathering is important but less time-consuming. Design and testing, while critical, don't match ETL's volume.

Defect Management processes typically include defect prevention (through reviews and quality practices), defect tracking/resolution, and management reporting for visibility. Deliverable base-lining is a Configuration Management activity related to version control and change management, not part of the defect management lifecycle.

360 is a separate product provided by a third party that offers a different view of the security model. It is not a Business Objects add-on or a report development tool. Instead, it's an external security management solution that provides an alternative interface and approach to managing the same underlying security model.

iProcess Insight is actually process mining and analysis, not business rules management. Business rules management would typically be handled by other tools or modules within the iProcess suite.

Model status should correspond to Development or Testing phases, not Operational use. When a procedure is in Model status, it is still being developed or tested and should not be used for live operational processing. The correct lifecycle is: Incomplete/Unreleased → Development/Testing, then Released → Operational, and Withdrawn → Phase-out.

In IBM Rational Quality Manager (RQM), a 'release' maps to a 'Project' and a 'project' maps to a 'Test plan'. This is the standard terminology mapping in RQM's hierarchical structure.

Requirement traceability matrix (RTM) is a document that links requirements to test cases and is typically created during requirements management or verification phase, not during the core requirement analysis activity. Issuing documents, doubt clarification, and scope clarification are all integral parts of the requirement analysis process where requirements are gathered, analyzed, and defined.

Use case diagrams are primarily used during requirement gathering to capture functional requirements and user-system interactions. While they may be referenced during development, their main purpose is in the requirements phase.