Security by Design ECDE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the main goal of a security-focused design review?

   • ATo ensure the user interface is intuitive
   • BTo review the code for syntax errors
   • CTo evaluate the proposed design for potential security weaknesses and improvements
   • DTo test the application's performance under load
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A DevSecOps team is designing a new customer-facing API that will handle payment card data. The team wants to ensure that security is integrated from the start. During the design phase, they conduct a threat modeling session and identify that an attacker could tamper with the payment amount in transit. Which of the following is the MOST appropriate security requirement to add to the design?

   • AThe API must validate that the payment amount is a positive number before processing.
   • BThe API must log all payment requests to an immutable audit log.
   • CAll API responses must include a checksum of the payload to detect tampering.
   • DThe API must use TLS 1.2 or higher with strong cipher suites for all communications.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A startup is building a new SaaS product. The CTO wants to 'shift left' security. Which practice best aligns with this goal?

   • APurchasing an expensive WAF and placing it in front of the application
   • BPerforming a full penetration test after each release
   • CHiring a dedicated security team to review code after it is merged
   • DIncluding security stories in the product backlog and conducting threat modeling during sprint planning
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is designing a new system that will process highly sensitive data. The security architect proposes a defense-in-depth strategy. However, the development team is concerned about performance and user experience. Which of the following approaches BEST balances security and usability?

   • AImplement strong security controls at the most critical layers, and use risk-based authentication to reduce friction for low-risk actions.
   • BImplement security controls only during the design phase and rely on monitoring after deployment.
   • CImplement all security controls at the network layer to minimize impact on application performance.
   • DImplement multiple layers of security controls, but allow users to bypass some controls for a smoother experience.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is designing a web application that will be publicly accessible. The security architect wants to implement defense in depth. Which of the following is the BEST example of this pattern?

   • AConducting regular penetration tests after deployment.
   • BUsing a strong password policy for all users.
   • CEncrypting all data at rest and in transit.
   • DPlacing a web application firewall (WAF) in front of the application and also implementing input validation in the application code.
   Reveal Solution Discussion Select an answer first