Security by Design ECDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A DevSecOps team is building a new CI/CD pipeline. The security team wants to ensure that secrets are not exposed in build logs. Which design decision best addresses this requirement?

   • AEncrypt secrets in the repository using a shared key
   • BUse a dedicated secrets management service and reference secrets by identifier in build scripts
   • CUse a custom build script that masks secrets after they are used
   • DStore secrets in environment variables in the CI/CD configuration
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team is starting a new project. The security team wants to ensure that security is considered from the initial design phase. Which of the following is the MOST effective way to achieve this?

   • ARun a penetration test after the application is deployed.
   • BUse a SAST tool during the build stage.
   • CProvide developers with a security checklist to follow during coding.
   • DConduct a security design review with the security team before any code is written.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which security architecture pattern involves implementing multiple layers of security controls so that if one layer fails, another layer provides protection?

   • ADefense in depth
   • BSingle point of failure
   • CLeast privilege
   • DSecurity through obscurity
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A team is designing a new system that will allow users to upload and share documents. The threat model identifies that an attacker could upload a malicious file that is then downloaded by other users. The team must choose a mitigation strategy. Which of the following is the MOST comprehensive approach?

   • AStore uploaded files in a separate domain and serve them with Content-Disposition: attachment and a random filename.
   • BAllow only images to be uploaded.
   • CImplement a combination of file type validation, content inspection, storage outside the web root, and serving files with safe headers.
   • DScan all uploads with a virus scanner and reject any that are flagged.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevSecOps team is starting a new microservices-based payment platform. The security lead insists on defining security requirements before any code is written. Which activity best exemplifies 'Security by Design' at this stage?

   • ARunning a SAST scan on the initial codebase as soon as the first module is committed
   • BSelecting a cloud provider that offers the most built-in security features
   • CPerforming a threat model on the proposed architecture and deriving security requirements from the identified risks
   • DScheduling a penetration test after the first release candidate is built
   Reveal Solution Discussion Select an answer first