Secure Coding Practices CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is adopting a secure development lifecycle (SDL) for their cloud applications. They want to integrate security practices into every phase of development. Which action best exemplifies this approach?

   • AHire a penetration testing firm to test the application after deployment.
   • BInclude security requirements in the design phase, perform code reviews during development, and conduct security testing before release.
   • CConduct a single security review just before the final release.
   • DProvide security training to developers once a year.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A development team uses several open-source libraries in their application. The security team discovers that one library has a known critical vulnerability. The library is used in a non-critical feature. What should the team do?

   • ARemove the library and rewrite the feature using only internal code.
   • BUpdate the library to a patched version as soon as possible and verify that the application still functions correctly.
   • CKeep the library and rely on a web application firewall (WAF) to block exploitation attempts.
   • DDisable the feature that uses the library until the next scheduled release.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team uses several open-source libraries in their cloud application. The security team wants to ensure that known vulnerabilities in these dependencies are identified and addressed. Which practice should they implement?

   • APin dependencies to specific versions and never update them.
   • BUse a software composition analysis (SCA) tool in the CI/CD pipeline to scan dependencies for known vulnerabilities.
   • COnly use libraries that are popular and widely used.
   • DManually review the source code of every third-party library before using it.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A team is designing a new cloud-based application that will handle sensitive health data. The application will be accessed by patients and healthcare providers. The team must ensure that patients can only view their own records, while providers can view records for their assigned patients. Which threat modeling approach best addresses this requirement?

   • AUse encryption for all data in transit and at rest to prevent unauthorized access.
   • BModel the trust boundaries between patients, providers, and the application, and identify threats related to horizontal and vertical privilege escalation.
   • CFocus on network-level threats and ensure the application is protected by a firewall.
   • DConduct a code review after development to find authorization issues.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A development team uses a popular open-source library that has a critical vulnerability. The library is widely used in the application, and no patched version is available yet. The application is scheduled for release in two weeks. What is the best course of action?

   • AUse a different library with similar functionality, even if it is less popular.
   • BRemove the library and rewrite all functionality that depends on it before the release.
   • CDelay the release indefinitely until the library is patched.
   • DAssess the exploitability of the vulnerability in the application's context and implement compensating controls if needed.
   Reveal Solution Discussion Select an answer first