Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A threat modeling team is analyzing a new payment processing system. They have identified that the system accepts credit card numbers, stores them temporarily in a database, and sends them to a third-party processor. The team is debating whether the third-party processor is a trust boundary. Which consideration is most important in making this determination?

   • AThe third-party processor's physical location and data center security.
   • BThe level of trust the organization places in the third-party processor's security controls.
   • CThe cost of the third-party service.
   • DThe speed of the network connection between the systems.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A startup is building a customer-facing web application that will handle payment card data. The architecture team is deciding how to structure the application to minimize the impact of a potential web server compromise. They plan to use a three-tier architecture with a separate database server. Which additional design decision best applies the principle of least privilege to limit lateral movement?

   • APlace the web, application, and database servers on the same subnet to simplify firewall rules and reduce latency.
   • BUse the same database credentials for all application modules to simplify configuration management.
   • CGrant the web server direct read/write access to the database to avoid the extra hop through the application server.
   • DConfigure the application server to connect to the database using an account that has only the specific stored procedures it needs to execute.
   Reveal Solution Discussion Select an answer first