8.5 - Define and Apply Secure Coding Guidelines and Standards CISSP Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   A company is designing a public API for a third-party integration. The API will handle sensitive customer data. The security team requires that the API authenticate callers and also ensure that each caller can only access their own data. Which combination of mechanisms is the most appropriate?

   • AUse basic authentication with the customer's username and password.
   • BUse a shared API key for all third-party partners and rely on the network firewall.
   • CUse JWT tokens that contain the user ID and trust the token without further checks.
   • DUse OAuth 2.0 with scopes for authorization and enforce object-level permissions in the API logic.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization wants to enforce a consistent security baseline across all its cloud workloads. The security team is considering using infrastructure as code (IaC) templates. How does this approach relate to software-defined security?

   • AIt allows security controls to be defined and deployed as code, ensuring consistency and auditability.
   • BIt shifts all security responsibility to the cloud provider.
   • CIt eliminates the need for runtime security monitoring.
   • DIt is only applicable to on-premises environments.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   An organization is moving from a monolithic application to a microservices architecture. The security team wants to enforce consistent authentication and authorization across all services. They are considering a service mesh with sidecar proxies. What is the primary security benefit of this approach?

   • AIt provides a single point of failure for all security controls.
   • BIt automatically patches all application vulnerabilities.
   • CIt centralizes security policy enforcement, such as mTLS and access policies, at the network layer.
   • DIt eliminates the need for application-level authentication.
   Reveal Solution Discussion Select an answer first