Secure Design Principles CASENET Practice Questions (Page 10)

Questions 46–48

1. 46expert · hard

   A .NET application has a public-facing search feature that queries a database. The search feature is essential for the business. The team wants to reduce the attack surface while maintaining the feature. Which approach is the most appropriate?

   • AAdd a WAF in front of the search feature and rely on it to block attacks.
   • BDisable the search feature and provide a static list of results.
   • CUse parameterized queries and restrict the database account used by the search feature to read-only access.
   • DMove the search feature to a separate server and use a different database.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A .NET web application has a login form that is vulnerable to brute-force attacks. The team wants to implement a mitigation that aligns with defense in depth. Which combination of controls should they implement?

   • AOnly a strong password policy.
   • BOnly CAPTCHA on the login form.
   • COnly rate limiting on the login endpoint.
   • DAccount lockout after a threshold of failed attempts, CAPTCHA after repeated failures, and multi-factor authentication for all users.
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   A .NET application has a legacy admin module that is only used by a few internal users. The module is currently accessible from the internet. The team wants to reduce the attack surface without breaking functionality. Which approach is the most effective?

   • ADisable the admin module entirely and use a third-party tool.
   • BMove the admin module to a separate internal network segment and require VPN access for all users.
   • CAdd multi-factor authentication to the admin module but keep it on the internet.
   • DHide the admin module's URL and rely on security through obscurity.
   Reveal Solution Discussion Select an answer first