Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a best practice for logging security-relevant events to support auditability?

   • ALogging all user input verbatim, including passwords
   • BStoring logs without any access controls
   • CLogging events with timestamps and user identifiers
   • DDisabling logging in production to improve performance
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security architect is using an attack tree to analyze a web application that allows users to upload files. The root goal is 'attacker gains remote code execution on the server.' Which branch represents a realistic sub-goal that should be included in the attack tree?

   • ASend a specially crafted HTTP header to the server.
   • BUpload a file with a double extension such as 'malicious.php.jpg'.
   • CGuess the administrator's password.
   • DPerform a denial-of-service attack on the server.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application accepts a user's age in a form field. The developer wants to ensure the input is valid before processing. Which input validation approach is most robust?

   • AAccept any input and rely on the database to handle it
   • BValidate that the input is an integer within a reasonable range (e.g., 0-120)
   • CReject any input that contains the string '<script>'
   • DConvert the input to a string and truncate to 3 characters
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer is implementing a feature that must verify the integrity of a downloaded file. The developer has the original file's hash value. Which cryptographic technique should be used?

   • ADecrypt the file with the private key
   • BEncrypt the file with AES and compare the ciphertext
   • CCompare the SHA-256 hash of the downloaded file to the known hash
   • DUse base64 encoding to check the file size
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team is implementing error handling for a web application. They want to ensure that error messages do not leak sensitive information to users, while still allowing support staff to diagnose issues. Which approach best meets these requirements?

   • ALog detailed error information server-side and show generic error messages to users.
   • BDisplay detailed error messages to all users to help them understand the problem.
   • CReturn a 404 status code for all errors to avoid revealing the existence of the resource.
   • DSend detailed error messages to the user's email address instead of displaying them on screen.
   Reveal Solution Discussion Select an answer first