Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In UML-style abuse case diagramming, what does an actor typically represent?

   • AA security control such as a firewall
   • BA person or system that interacts with the system, including malicious actors
   • CA database table that stores user credentials
   • DA system component that processes data
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An architect is reviewing an abuse case diagram for a healthcare portal. The diagram shows a 'Patient' actor and an 'Attacker' actor, with a misuse case 'Steal Patient Data' connected to the 'View Medical Records' use case. What does this connection represent?

   • AThe attacker can achieve the misuse case by abusing the 'View Medical Records' use case.
   • BThe attacker is a legitimate actor who can view medical records.
   • CThe diagram shows that the attacker is a subclass of the patient actor.
   • DThe 'View Medical Records' use case is a security use case that prevents the attack.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team is documenting the functional behavior of a new online payment portal. The business analyst has written use cases describing how a customer initiates a payment, how the system processes the transaction, and how a receipt is generated. The security lead wants to ensure the team also captures malicious scenarios. Which approach best aligns with the security lead's goal?

   • ACreate abuse cases for each use case by identifying an attacker, a goal, and a sequence of actions that subvert the payment flow.
   • BAdd a new use case titled 'Prevent fraud' that describes the system's anti-fraud features in detail.
   • CAsk the penetration tester to list all vulnerabilities found in the previous release and map them to use cases.
   • DRewrite the existing use cases to include negative paths such as 'customer enters invalid card number'.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A team is developing a multi-tenant SaaS application. They have a use case 'Upload File' that allows tenants to upload documents. The security team wants to create abuse cases. They have limited time and must prioritize the most critical abuse cases. Which approach best prioritizes abuse cases?

   • AFocus on abuse cases that involve cross-tenant data access and malware upload, as they have high impact.
   • BOnly create abuse cases for threats that have been seen in other applications.
   • CCreate abuse cases for every possible misuse, regardless of likelihood or impact.
   • DWait until the application is deployed and then create abuse cases based on real attacks.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A team has an abuse case where an attacker can inject malicious SQL by manipulating search input. They are defining a security use case. The application is a legacy .NET Web Forms app with many existing queries. The team wants to minimize code changes. Which security use case is most appropriate?

   • AEncode all output to prevent SQL injection.
   • BUse parameterized queries or stored procedures for all database access.
   • CImplement input validation that blocks known SQL keywords.
   • DUse a web application firewall (WAF) to filter malicious requests.
   Reveal Solution Discussion Select an answer first