Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A product manager asks the security team to add a 'security use case' for every use case in the system. The team has limited resources. Which approach best addresses the request?

   • ACreate security use cases only for use cases that involve sensitive data.
   • BCreate a security use case for every use case, even if no abuse case exists.
   • CAsk the product manager to approve a list of all possible security use cases before starting.
   • DPrioritize security use cases based on the risk level of the associated abuse cases.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which statement best describes the purpose of an abuse case?

   • ATo identify and document potential security threats by modeling attacker behavior
   • BTo document the functional requirements of a system from the user's perspective
   • CTo capture the system's performance and scalability requirements
   • DTo define the system's user interface and interaction design
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A team has an abuse case where an attacker can upload a malicious file that executes on the server. They have defined a security use case that requires file type validation and storing files outside the web root. However, the operations team is concerned about the cost of storing files outside the web root. Which approach best addresses the abuse case while considering operational constraints?

   • AStore files in the web root but with a .txt extension to prevent execution.
   • BStore files in a separate storage service with restricted execution permissions.
   • CStore files in the web root but set the file permissions to read-only.
   • DStore files in the web root and rely on the antivirus scanner to detect malicious files.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A team has an abuse case where an attacker can access another user's profile by modifying the user ID in the URL. Which security use case best mitigates this?

   • AThe system must encrypt the user ID in the URL.
   • BThe system must verify that the authenticated user is authorized to access the requested profile.
   • CThe system must log all profile access attempts.
   • DThe system must use a random session ID for each request.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security architect is updating the system design documentation for an e-commerce application. The team has identified several abuse cases, including 'Attacker performs a brute-force login' and 'Attacker submits a fraudulent coupon.' The architect wants to visualize these threats and their relationships to the system's use cases. Which approach is most appropriate?

   • ACreate a class diagram that includes an 'Attacker' class and an 'AbuseCase' class with associations to the existing classes.
   • BCreate a deployment diagram that shows which servers are exposed to the internet and could be attacked.
   • CCreate a UML use case diagram that includes the normal actors and use cases, and then overlay abuse cases as additional actors and use cases connected to the same system boundary.
   • DCreate a sequence diagram that shows the exact order of messages exchanged during a brute-force attack.
   Reveal Solution Discussion Select an answer first