Secure Coding Practices CSE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which of the following is an example of secure configuration for a cloud database service?

   • AUsing the default admin password because it is easy to remember
   • BLeaving the database publicly accessible to simplify development
   • CEnabling all database features to ensure compatibility
   • DRestricting network access to the database to only authorized application servers
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security team is planning security testing for a cloud application that uses a complex microservices architecture. They want to identify vulnerabilities that are specific to the interactions between services. Which testing approach is most effective?

   • APerform static analysis on each microservice independently.
   • BPerform dynamic analysis that tests the entire application from the user interface down to the microservices, including API-to-API interactions.
   • CConduct a penetration test on a single microservice in isolation.
   • DRun a vulnerability scanner on the cloud infrastructure only.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security team is conducting a code review of a cloud application. They have limited time and need to prioritize the most critical vulnerabilities. Which approach should they take?

   • AAsk the developers to review each other's code without a defined focus.
   • BRun a static analysis tool and only review the findings it reports.
   • CReview all code equally, line by line, to ensure nothing is missed.
   • DFocus on areas that handle sensitive data, authentication, and input validation, using a risk-based approach.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A cloud application uses role-based access control (RBAC). A user with the 'viewer' role can access a sensitive report by directly entering the report's URL, even though the UI does not show the link. The application uses a single-page frontend and a REST API. The security team must fix this. What is the root cause and the best fix?

   • AThe report is stored in a public cloud storage bucket; move it to a private bucket.
   • BThe API lacks server-side authorization checks; enforce authorization on every API endpoint based on the user's role.
   • CThe user's session token is weak; regenerate the session token after login.
   • DThe frontend should hide the report URL from the viewer role; fix the UI to not render the link.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which principle ensures that users are granted only the minimum permissions necessary to perform their tasks?

   • AFail-open design
   • BLeast privilege
   • CSeparation of duties
   • DDefense in depth
   Reveal Solution Discussion Select an answer first