8.5 - Define and Apply Secure Coding Guidelines and Standards CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is developing a microservices architecture where services communicate over HTTP. The security team wants to ensure that only authenticated and authorized services can call each other. Which control is most appropriate for service-to-service authentication?

   • AUse mutual TLS (mTLS) with certificates for each service.
   • BRely on the internal network to isolate services from external access.
   • CInclude a shared secret in the HTTP header of every request.
   • DUse JSON Web Tokens (JWTs) signed with a symmetric key.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of insecure error handling in source code?

   • ACatching exceptions and logging them with a correlation ID
   • BValidating input before processing
   • CLogging detailed exception messages to the application log
   • DReturning a generic error page to the user
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A development team is building a public-facing web application that accepts file uploads from users. The application is behind a load balancer and uses a content delivery network (CDN). The security team requires protection against malicious file uploads that could lead to remote code execution. Which combination of controls is the most robust?

   • AStore uploaded files in a database as BLOBs and retrieve them via a script.
   • BCheck the file extension against a blocklist of dangerous extensions.
   • CRely on the CDN to sanitize all uploaded files.
   • DValidate file type by magic bytes, store files outside the web root, and serve them with a Content-Disposition header.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In API security, what is the primary purpose of rate limiting?

   • ATo encrypt data in transit between client and server
   • BTo prevent brute-force attacks and denial-of-service conditions
   • CTo validate the format of input data
   • DTo authenticate the identity of the API consumer
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer is building a public API that allows clients to query order information. The API uses an API key for authentication, but any authenticated client can view any order. The business requirement is that customers should only see their own orders. What is the most important security control to add?

   • ARequire a stronger authentication method, such as OAuth 2.0 with client credentials.
   • BImplement object-level authorization checks that verify the authenticated user owns the requested order.
   • CAdd rate limiting to prevent excessive requests from a single client.
   • DEncrypt the order IDs in the URL to make them harder to guess.
   Reveal Solution Discussion Select an answer first