Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of using UML-style diagrams to model abuse cases?

   • ATo document the system's performance metrics
   • BTo replace the need for security testing
   • CTo automatically generate secure code
   • DTo visualize the relationships between threats and system components
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a step in the process of creating abuse cases from use cases?

   • ADefine the system's user interface layout
   • BIdentify the system's hardware requirements
   • CConsider how each use case could be misused by an attacker
   • DDetermine the system's deployment architecture
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A team is creating abuse cases for a new online payment system. They have limited time and need to prioritize which abuse cases to document. The system has several use cases: 'Make payment,' 'View transaction history,' 'Update profile,' and 'Contact support.' Which approach best prioritizes abuse case creation?

   • ACreate abuse cases for all use cases equally, regardless of importance, to ensure complete coverage.
   • BFocus on the use cases that handle sensitive data or critical business functions, such as 'Make payment' and 'View transaction history,' and create abuse cases for those first.
   • CCreate abuse cases only for use cases that have a user interface, since those are more likely to be attacked.
   • DCreate abuse cases only for use cases that were mentioned in the latest security audit report.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial application has a 'Transfer Funds' use case. The team identified an abuse case where an attacker can transfer funds without authorization by tampering with the transaction amount. They defined a security use case that requires server-side validation of the transaction amount. However, the product owner is concerned that adding validation will slow down the user experience. The team must balance security and usability. Which approach best addresses the abuse case while minimizing impact on legitimate users?

   • AImplement server-side validation with a clear error message and a quick client-side check for immediate feedback.
   • BLog all transaction amounts and review them weekly.
   • CAdd a CAPTCHA after every transaction to slow down automated attacks.
   • DSkip server-side validation to keep the user experience fast, and rely on client-side validation only.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A team is writing security use cases for an abuse case where an attacker can perform a cross-site request forgery (CSRF) attack on a banking application. The team has proposed several security use cases. Which one is the most effective and appropriate?

   • AThe system shall use a CAPTCHA on all forms.
   • BThe system shall require the user to re-enter their password for every transaction.
   • CThe system shall check the HTTP Referer header to ensure requests come from the same origin.
   • DThe system shall include a unique anti-CSRF token in every state-changing request and validate it on the server side.
   Reveal Solution Discussion Select an answer first