Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a threat modeling session, the team identifies that an attacker could exploit a SQL injection vulnerability in a legacy login form. The form is scheduled to be replaced in six months. The team decides to add a Web Application Firewall (WAF) rule to block suspicious SQL patterns while the code fix is being developed. This is an example of which risk mitigation strategy?

   • ARisk avoidance
   • BRisk transfer
   • CRisk reduction
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A web application uses session cookies for user authentication. The security team has noticed that the session ID is predictable because it is generated using a timestamp and the user's IP address. Which change should be made to improve session management security?

   • ARegenerate the session ID only when the user logs out.
   • BStore the session ID in a JavaScript variable instead of a cookie.
   • CSet the session cookie's Domain attribute to the parent domain to allow single sign-on.
   • DUse a cryptographically secure random number generator to create session IDs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A web application uses session cookies to maintain user login state. The security team wants to reduce the risk of session hijacking via cross-site scripting (XSS). Which cookie attribute is most directly effective?

   • ASameSite
   • BHttpOnly
   • CSecure
   • DDomain
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A development team is starting a threat modeling exercise for a new mobile banking application. They have identified the user's device, the backend API, and the database as key components. According to the threat modeling process, what should they do immediately after identifying assets and entry points?

   • AApply STRIDE to each component
   • BIdentify trust boundaries between the components
   • CSelect mitigation controls for each entry point
   • DCalculate risk scores for each asset
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A development team is fixing a buffer overflow vulnerability in a C++ application that processes network packets. The team must choose a mitigation strategy that balances security with performance. Which approach is most effective?

   • AIncrease the buffer size to accommodate larger inputs
   • BDisable compiler optimizations to reduce risk
   • CAdd ASLR and DEP to the system
   • DUse bounds checking and safe library functions (e.g., std::string, std::vector)
   Reveal Solution Discussion Select an answer first