Security by Design ECDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is an example of a well-defined security acceptance criterion?

   • AThe login feature must lock the account after 5 consecutive failed attempts
   • BThe login feature should use strong passwords
   • CThe login feature should be easy to use
   • DThe login feature should be secure
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a design review for a new customer-facing web application, the team uses STRIDE to analyze the architecture. They identify a spoofing threat where an attacker could impersonate another user. Which secure architecture pattern most directly mitigates this threat?

   • AEncrypting data in transit using TLS
   • BApplying least privilege to database service accounts
   • CSegmenting the network into separate subnets
   • DImplementing strong authentication mechanisms such as multi-factor authentication
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is adopting a DevSecOps culture. The security team wants to integrate security into the design phase, but developers are resistant because they feel it slows down delivery. Which of the following is the BEST strategy to overcome this resistance?

   • AUse a risk-based approach: conduct full design reviews for high-risk features and lightweight security checklists for low-risk features.
   • BDefer all security reviews until after the feature is developed.
   • CAutomate security testing and remove human reviews entirely.
   • DMandate a full security design review for every feature, with no exceptions.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security architect is conducting a design review of a new payment processing system. The design uses a monolithic application with a single database. The team is concerned about the blast radius if the application is compromised. Which design change would most effectively reduce the blast radius?

   • AImplementing a CDN for static content
   • BEncrypting the database at rest
   • CSplitting the monolith into microservices with separate databases and least-privilege access
   • DAdding a WAF in front of the application
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During a security design review of a new microservices architecture, the team discovers that the service-to-service communication uses unauthenticated HTTP. Which of the following is the BEST recommendation to address this issue?

   • AUse a shared API key for all services to authenticate requests.
   • BAdd a timestamp to each request to prevent replay attacks.
   • CImplement mutual TLS (mTLS) between services to ensure both identity and encryption.
   • DRely on the internal network to protect the communication.
   Reveal Solution Discussion Select an answer first