Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A team has defined an abuse case where an attacker can access sensitive data by exploiting a broken access control in a REST API. They have defined a security use case that requires role-based access control (RBAC) checks on every API endpoint. The team is now integrating this into the system design. Which integration step is most critical to ensure the security use case is effective?

   • ADocument the RBAC requirements in the API documentation.
   • BAdd automated tests that verify RBAC checks are enforced on every endpoint.
   • CUse a code review checklist that includes RBAC checks.
   • DAdd RBAC checks only to endpoints that handle sensitive data.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team is starting abuse case modeling for a new document management system. They have identified the primary use case 'User uploads a document.' Which sequence of steps best follows the abuse case creation process?

   • AWrite a detailed abuse case for every possible input validation error, then convert each into a unit test.
   • BAsk stakeholders to rank the importance of each use case, then document the top three as abuse cases.
   • CList all possible system failures, assign a severity rating, and then prioritize which failures to fix first.
   • DIdentify potential attackers, define their goals, enumerate misuse scenarios for the upload use case, and then derive security use cases to mitigate those scenarios.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst has documented an abuse case where an attacker bypasses authentication by replaying a captured session token. The team needs to define a security use case to mitigate this. What should the security use case specify?

   • AThe system must log all authentication attempts and alert on failures.
   • BThe system must invalidate session tokens after a period of inactivity and on logout.
   • CThe system must use HTTPS for all network communications.
   • DThe system must require users to change passwords every 90 days.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A team has identified an abuse case where an attacker can upload a malicious file to a document management system. They have defined a security use case to validate file types and scan for malware. What is the next step to ensure the security requirement is addressed?

   • AAdd the security use case to the user manual.
   • BRemove the abuse case from the threat model because a security use case exists.
   • CDocument the abuse case in the threat model and close the issue.
   • DIntegrate the security use case into the system design and development backlog.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the first step in creating abuse cases from use cases?

   • ADeploy the system to a production environment
   • BImplement security controls to mitigate threats
   • CWrite detailed test cases for the system
   • DIdentify potential malicious actors and their goals
   Reveal Solution Discussion Select an answer first