Security by Design ECDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is designing a new internal tool that will access a legacy database. The database administrator wants to give the application a service account with broad permissions to simplify development. Which design principle should the security team advocate for?

   • ASeparation of duties, requiring two administrators to approve database changes
   • BFail secure, ensuring the application fails closed if the database is unavailable
   • CLeast privilege, granting only the specific database operations the application needs
   • DDefense in depth, adding a firewall between the application and the database
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A team is designing a new API that will handle sensitive personal data. During threat modeling, they use the STRIDE model. Which threat category is most directly addressed by implementing rate limiting and input validation?

   • AInformation disclosure
   • BDenial of service
   • CSpoofing
   • DElevation of privilege
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is conducting a security design review for a new authentication service. The proposed design uses a shared secret stored in the application code. Which of the following is the BEST recommendation to improve the design?

   • AUse a longer and more complex secret to make it harder to guess.
   • BEncrypt the secret in the code using a hard-coded encryption key.
   • CAdd a comment in the code warning developers not to share the secret.
   • DMove the secret to a secure vault and reference it via environment variables or a secrets management API.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is designing a new REST API that will expose customer data. During the design review, they want to define security requirements. Which of the following is the MOST important requirement to include?

   • AThe API must use OAuth 2.0 with short-lived access tokens for authentication and authorization.
   • BThe API must be documented using OpenAPI specification.
   • CThe API must return error messages in a user-friendly format.
   • DThe API must be versioned to allow backward compatibility.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which statement best describes the core principle of 'Security by Design' in software development?

   • ASecurity is a feature that can be added after the application is fully developed
   • BSecurity is an integral part of every phase of the development lifecycle, from requirements to deployment
   • CSecurity is only relevant during the testing phase
   • DSecurity is primarily the responsibility of the security team, not the developers
   Reveal Solution Discussion Select an answer first