Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevSecOps team is establishing a secure development lifecycle for a new application. They want to ensure that security requirements are considered from the beginning. Which activity should they perform during the requirements phase?

   • APerform a penetration test on the production environment.
   • BConduct a threat modeling session to identify potential security requirements.
   • CRun a SAST scan on the codebase.
   • DDeploy a web application firewall to protect the application.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A threat modeling team is analyzing a system that includes a public-facing web server, an internal application server, and a database. They have identified the web server as an entry point and the database as a key asset. They are now creating a data flow diagram. What is the most important element to include to ensure the threat model is accurate?

   • AThe names of the developers who wrote the code
   • BThe physical location of each server
   • CThe brand and model of the servers
   • DTrust boundaries between the web server, application server, and database
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which cryptographic technique is used to verify the integrity of data by producing a fixed-size string that changes if the data is altered?

   • ASymmetric encryption
   • BHashing
   • CAsymmetric encryption
   • DDigital signature
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A company is adopting a DevSecOps approach and wants to integrate security into their CI/CD pipeline. They have a mix of legacy and modern applications. Which strategy best balances security and development speed?

   • ARequire a full penetration test before every deployment
   • BDeploy security testing only in a separate monthly release cycle
   • CUse only developer training and code reviews
   • DRun automated SAST and dependency scanning in the pipeline, with manual review for critical changes
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is designing a new customer-facing web portal that will handle payment data. The architecture team wants to ensure that even if the web server is compromised, the attacker cannot directly access the database. Which secure design principle should be the primary driver for the network segmentation and firewall rules?

   • ADefense in depth
   • BSeparation of duties
   • CLeast privilege
   • DFail-safe defaults
   Reveal Solution Discussion Select an answer first