Secure Deployment and Maintenance CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Java application's configuration management system uses a central server to push configuration changes. The security team wants to ensure that only authorized administrators can make changes, but the operations team needs to be able to quickly revert changes if they cause issues. Which approach best meets both requirements?

   • AAllow all administrators to make changes without logging, but keep a copy of the previous configuration.
   • BDisable the configuration management system and make changes directly on each server.
   • CUse a shared administrator account for all configuration changes to simplify management.
   • DImplement role-based access control (RBAC) on the configuration management system and maintain versioned configuration history for rollback.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which logging practice is most effective for detecting security incidents in a Java application?

   • ALogging all user input in plain text for debugging
   • BDisabling logging in production to improve performance
   • CLogging only application errors and exceptions
   • DLogging security-relevant events such as authentication failures and access control decisions
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company runs a Java application on Tomcat with a MySQL backend. A recent audit found that the application connects to the database using the 'root' account with a password stored in a properties file on the classpath. The security team requires a quick remediation that reduces the blast radius of a credential leak without requiring a full application rewrite. Which approach best addresses the finding?

   • AChange the database password and update the properties file with the new value
   • BMove the credentials to a JNDI DataSource in Tomcat's context.xml and reference it from the application
   • CSet the database user's host restriction to only allow connections from the application server's IP
   • DEncrypt the properties file using a hardcoded key in the application's main class
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A DevOps team is automating the deployment of a Java microservice to a Kubernetes cluster. The security policy requires that container images be scanned for vulnerabilities before deployment. Which control should be integrated into the CI/CD pipeline?

   • ARely on the container registry's built-in scanning and only review the results after deployment.
   • BDisable scanning to speed up the pipeline and reduce build times.
   • CScan the images manually once a month using a standalone tool.
   • DRun a container image vulnerability scanner as a step in the pipeline and fail the build if critical vulnerabilities are found.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is configuring logging for a Java application that handles payment transactions. The compliance team requires that any security-relevant event, such as a failed login or a payment authorization failure, must be recorded with enough detail to support a forensic investigation. The application uses SLF4J with Logback. Which logging configuration best meets this requirement?

   • ALog all events at DEBUG level to a single rotating file with a 30-day retention period
   • BLog security events to the application's standard output and rely on the container's log driver for collection
   • CCreate a dedicated logger for security events and configure it to write to a separate, append-only file with a 1-year retention period
   • DUse a custom appender that sends security events to a Syslog server with a 7-day retention policy
   Reveal Solution Discussion Select an answer first