Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In the threat modeling process, which step involves identifying the data and resources that need protection, such as customer records, encryption keys, and intellectual property?

   • AIdentifying assets
   • BIdentifying entry points
   • CIdentifying threats
   • DIdentifying trust boundaries
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   To prevent SQL injection attacks, which of the following is the most effective secure coding practice?

   • AUsing parameterized queries
   • BUsing dynamic SQL strings
   • CBlacklisting dangerous characters
   • DEncoding all user input
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   After identifying a potential threat, a security analyst evaluates the probability of it occurring and the potential damage it could cause. Which step of the risk assessment process is the analyst performing?

   • AThreat identification
   • BRisk acceptance
   • CRisk analysis
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security audit reveals that the application's error handling reveals stack traces to end users. The development team wants to fix this without losing the ability to debug issues. Which approach should they take?

   • AUse a custom error page that shows the stack trace in a formatted way.
   • BRemove all error handling so that errors are not displayed at all.
   • CConfigure the application to log stack traces to a secure log file and display a generic error page to users.
   • DDisplay the stack trace only to users with administrative privileges.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company is deploying a new internal web application that will be accessed by employees from both the corporate network and remote locations. The application uses a single sign-on (SSO) system. The security team wants to apply the principle of least privilege to user access. Which approach best achieves this?

   • AAllow managers to manually grant access to any employee on request.
   • BGrant all employees the same level of access to the application to simplify management.
   • CRequire all employees to use a VPN to access the application, regardless of their role.
   • DUse role-based access control (RBAC) to assign permissions based on job functions.
   Reveal Solution Discussion Select an answer first