Secure Application Design and Architecture CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Java application logs all user actions for audit purposes. The logs include the user's IP address, timestamp, and the action performed. The security team is concerned about log tampering by an attacker who gains access to the application server. Which of the following is the most effective control to protect the integrity of the logs?

   • AUse a hash chain to detect tampering after the fact.
   • BSend logs to a remote, write-only log server with restricted access.
   • CEncrypt the log files on the application server.
   • DStore logs in a database on the same server.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important for security requirements to be testable and traceable?

   • ATo eliminate the need for security testing.
   • BTo satisfy regulatory compliance only.
   • CTo make the requirements more complex and difficult to implement.
   • DTo ensure that security requirements can be verified and linked to business needs.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Java application is being designed for a healthcare provider. It must allow patients to view their medical records online and allow doctors to update them. The application must comply with data protection regulations that require strong authentication for accessing health data. The design team is considering using OAuth 2.0 with OpenID Connect for authentication. Which of the following is the most important design consideration to ensure secure authentication and authorization?

   • AStore access tokens in local storage on the client for easy retrieval.
   • BUse long-lived access tokens to minimize the number of authentication requests.
   • CUse short-lived access tokens and refresh tokens with proper scope validation on every request.
   • DRely on the OAuth provider to handle all authorization decisions without application-level checks.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Java application stores customer PII in a database. The compliance team requires that the data be protected at rest. Which design is most appropriate?

   • AStore the data in plaintext but restrict access to the database to a single administrator.
   • BRely on the database server's firewall to protect the data at rest.
   • CUse only application-level encryption for all columns, including non-sensitive ones.
   • DEncrypt the entire database using transparent data encryption (TDE) and encrypt sensitive columns with application-level encryption.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Java application integrates with a third-party payment API. The integration requires sending sensitive customer data. Which architecture pattern best ensures secure communication and data protection?

   • ASend data over the internal network without encryption because the API is trusted.
   • BRely on the payment provider's web application firewall to protect the data.
   • CUse basic authentication with the API key in the URL to simplify integration.
   • DUse TLS for all API calls and encrypt sensitive fields with the payment provider's public key before transmission.
   Reveal Solution Discussion Select an answer first