Security by Design ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of defining security requirements and acceptance criteria for a software feature?

   • ATo document the feature's functionality for end users
   • BTo ensure that the feature is delivered on time and within budget
   • CTo provide a clear, testable definition of what constitutes a secure implementation
   • DTo satisfy regulatory compliance without affecting the design
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   During a security design review of a new application, the team identifies that the design uses a single shared database account for all services. The security lead wants to recommend a change. However, the development team argues that separate accounts would increase operational overhead. Which of the following is the BEST recommendation that addresses the security concern while minimizing operational impact?

   • ACreate separate accounts for each service, but automate credential management using a secrets vault and dynamic credential generation.
   • BUse a single account but rotate the password frequently.
   • CUse a single account but restrict access using database views and stored procedures.
   • DKeep the single account but add a comment in the code reminding developers to be careful.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During the design review of a new file upload feature, the team identifies that users can upload files that are later served back to other users. The security lead wants to define a security requirement with clear acceptance criteria. Which requirement statement is the MOST testable and actionable?

   • AThe system must reject files larger than 10 MB and with extensions not in the allowed list.
   • BThe system should prevent malicious file uploads.
   • CThe system should use a virus scanner on all uploaded files.
   • DThe system must validate file content against expected signatures, store files outside the web root, and serve them with Content-Disposition: attachment.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A team is designing a new feature that allows users to share files. The security team wants to ensure that security requirements are defined early. Which of the following is the MOST important security requirement to include?

   • AThe system must allow users to share files via email links.
   • BThe system must support large file uploads up to 10 GB.
   • CThe system must enforce access control so that only authorized users can view or download shared files.
   • DThe system must provide a user-friendly interface for sharing files.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In the context of secure architecture patterns, what does the principle of 'least privilege' require?

   • AUsers and processes should have only the minimum permissions necessary to perform their functions
   • BAccess rights should be granted based on the user's seniority
   • CAll users should have the same level of access to simplify management
   • DAdministrators should have unlimited access to all resources
   Reveal Solution Discussion Select an answer first