Secure Application Design and Architecture CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Java application is being designed to integrate with a third-party payment API. The architecture must ensure that the API credentials are not exposed to the client-side code and that all communication with the API is encrypted. Which secure architecture pattern should be applied?

   • AUse a client-side certificate installed on the user's device to authenticate to the payment API.
   • BEmbed the API credentials in the JavaScript client and call the payment API directly over HTTPS.
   • CUse a server-side proxy that holds the API credentials and forwards requests to the payment API over TLS.
   • DStore the API credentials in a cookie on the client's browser and send them with each request.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Java application's logging system currently logs full request headers, including authorization tokens. The security team wants to reduce the risk of token leakage while maintaining auditability. Which approach is most effective?

   • ARedact authorization headers in logs and log a hash of the token for correlation.
   • BEncrypt the entire log file with a key stored in the application's configuration.
   • CDisable logging for all requests that include authorization headers.
   • DLog the full token to ensure traceability of user actions.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An application is designed with separate layers for presentation, business logic, and data access, each with its own security controls. Which secure architecture pattern does this represent?

   • AMicroservices architecture
   • BSecure communication
   • CLayered security
   • DSecure session management
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A business requirement states that 'the system must allow customers to view their order history.' Which of the following is a well-formed security requirement derived from this business requirement?

   • AThe system must be available 99.9% of the time.
   • BThe system must authenticate users before allowing access to order history.
   • CThe system must use HTTPS for all communications.
   • DThe system must store order data in a database.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   During a security design review of a Java application, the reviewer finds that the application uses a custom encryption algorithm for protecting data at rest. The reviewer also notes that the application does not use any standard security libraries. Which of the following is the most appropriate recommendation?

   • AReplace the custom algorithm with a well-vetted standard algorithm such as AES-256 and use established security libraries.
   • BKeep the custom algorithm because it is unique and harder for attackers to break.
   • CAdd more complexity to the custom algorithm to make it stronger.
   • DDocument the custom algorithm and ask for peer review before proceeding.
   Reveal Solution Discussion Select an answer first