Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A development team is starting a new banking web application. The security lead asks the team to identify potential threats by analyzing the 'Transfer Funds' use case. Which approach best aligns with abuse case modeling?

   • ADocument the use case in a formal specification and then send it to the security team for review.
   • BCreate a list of all possible security controls and map them to the use case steps.
   • CList all functional steps of the use case and then brainstorm how a malicious actor could exploit each step.
   • DReview the use case diagram and remove any actor that is not a primary actor.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a security use case?

   • AA functional requirement that describes how the system should mitigate an identified abuse case
   • BA test case that verifies the system's performance under load
   • CA scenario that describes how an attacker might exploit a vulnerability
   • DA non-functional requirement that specifies the system's availability
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A project manager is reviewing the requirements documentation for a healthcare portal. The document contains a use case titled 'Patient views lab results' and an abuse case titled 'Attacker views another patient's lab results by manipulating the URL parameter.' The team also wrote a security use case titled 'System verifies that the logged-in patient owns the requested record.' Which statement correctly describes the relationship among these three items?

   • AThe abuse case is derived from the use case, and the security use case is derived from the abuse case.
   • BAll three are independent requirements that happen to relate to the same feature.
   • CThe use case is derived from the abuse case, and the security use case is derived from the use case.
   • DThe abuse case and the security use case are both derived from the use case independently.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is documenting potential threats for a new online voting system. The analyst wants to describe a scenario where a malicious user attempts to vote multiple times by creating fake accounts. Which of the following best represents an abuse case?

   • AA user accidentally clicks the vote button twice and submits two votes.
   • BThe system logs each vote with a timestamp and IP address for audit purposes.
   • CAn attacker creates multiple fake accounts and submits votes for the same candidate to manipulate the outcome.
   • DThe system should verify that each user can vote only once by checking a unique identifier.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A team has identified an abuse case where an attacker can exploit a time-of-check-to-time-of-use (TOCTOU) vulnerability in a file upload feature. The team needs to write a security use case that mitigates this specific issue. Which security use case is most appropriate?

   • AThe system shall store uploaded files in a quarantine area and scan them with antivirus software.
   • BThe system shall open and process the file using the same file handle that was validated, and perform validation and processing atomically.
   • CThe system shall limit the size of uploaded files to 10 MB.
   • DThe system shall check the file extension and reject any file that is not in the allowed list.
   Reveal Solution Discussion Select an answer first