Secure Application Design and Architecture CASEJAVA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A Java application is designed with a microservices architecture. Each service communicates over HTTP. The security team wants to ensure secure communication between services. Which pattern is most appropriate?

   • AUse simple API keys in headers for authentication and rely on the internal network for confidentiality.
   • BUse a VPN between all services to secure communication.
   • CUse mutual TLS (mTLS) between services to authenticate both parties and encrypt traffic.
   • DUse JWT tokens for authentication and send data in plaintext over HTTP.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During a design review of a Java application, the team finds that sensitive data is stored in plaintext in a log file. Which recommendation is most appropriate?

   • AEncrypt the log file with a key stored in the same directory.
   • BUse a different log file for sensitive data and keep it in the web root.
   • CRemove all logging to prevent sensitive data from being stored.
   • DMask sensitive data in logs and ensure log files are protected with appropriate permissions.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   An application design includes multiple independent security controls, such as network firewalls, application-level input validation, and database encryption. Which security design principle does this illustrate?

   • AFail-safe defaults
   • BLeast privilege
   • CDefense in depth
   • DSecurity through obscurity
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A Java web application uses session-based authentication. The security team wants to prevent session fixation attacks. Which of the following design changes is most effective?

   • ASet a short session timeout to limit the window of attack.
   • BGenerate a new session ID after successful authentication and invalidate the old session.
   • CStore the session ID in a cookie with the Secure flag.
   • DUse a longer session ID to make guessing harder.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security architect is conducting a design review of a Java application that uses a microservices architecture. The review finds that each microservice has its own API gateway, and the gateways do not share a common authentication mechanism. The architect is concerned about inconsistent security controls. Which of the following is the most appropriate recommendation?

   • AKeep the separate gateways and ensure each one implements the same security controls manually.
   • BUse a service mesh to handle security at the network level instead of the application level.
   • CConsolidate the API gateways into a single gateway that handles authentication and authorization for all microservices.
   • DRemove the API gateways and let each microservice handle its own security.
   Reveal Solution Discussion Select an answer first