Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is implementing error handling for a web application. The current code returns detailed exception messages, including SQL query strings and stack traces, directly to the browser. Which change best aligns with secure error handling practices?

   • AReturn the exception message but remove the stack trace
   • BSuppress all error messages and log nothing
   • CDisplay the full stack trace only to authenticated administrators
   • DReturn generic error messages to users and log detailed errors server-side
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security analyst is using a structured approach to identify threats by categorizing them into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Which threat modeling methodology is the analyst using?

   • AAttack trees
   • BSTRIDE
   • CDREAD
   • DPASTA
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is using STRIDE to analyze a web application that allows users to upload profile pictures. The analyst wants to identify threats related to a user uploading a malicious file that could be executed on the server. Which STRIDE category does this threat primarily fall under?

   • ATampering
   • BSpoofing
   • CElevation of privilege
   • DDenial of service
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A developer is writing error handling code for a login function. Which of the following is a secure practice to avoid information leakage?

   • ALogging the user's password in the error log
   • BReturning a generic error message for both invalid username and invalid password
   • CReturning detailed error messages that include stack traces
   • DDisplaying the exact reason for failure to the user
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A development team is designing a new microservice that will handle sensitive customer data. The architect wants to ensure that if the service is compromised, the attacker's access is limited to the minimum necessary to perform the service's function. Which secure design principle is the architect applying?

   • ALeast privilege
   • BFail-safe defaults
   • CDefense in depth
   • DSeparation of duties
   Reveal Solution Discussion Select an answer first