Perform Secure Interface Design CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which control is most effective for ensuring log integrity?

   • AUsing write-once, read-many (WORM) storage or cryptographic hashing to detect tampering
   • BStoring logs in plain text on the same server that generates them
   • CAllowing administrators to edit logs directly
   • DEncrypting logs with a key stored on the same server
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare application needs to share patient data with a third-party analytics service. The data must be encrypted in transit and at rest. The two organizations need to establish a secure data-sharing mechanism. Which approach is most secure?

   • ASend data via SFTP to a shared server.
   • BUse a VPN tunnel and rely on the VPN for all security.
   • CUse mutual TLS (mTLS) with client certificates and encrypt the data with a key managed by a KMS.
   • DUse a shared API key and send data over HTTPS.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A large enterprise is designing the management network for its data center. The management network will be used by administrators to configure network devices and servers. The enterprise wants to ensure that management traffic is isolated from production traffic and remains available even if the production network is compromised. Which design best meets these requirements?

   • AUse a physically separate network with dedicated switches and routers for management.
   • BUse a cloud-based management solution accessible over the internet.
   • CUse the same network but encrypt management traffic with IPsec.
   • DUse a separate VLAN for management traffic and enforce strong ACLs.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is designing a centralized log aggregation system that receives logs from multiple applications over the network. The logs contain sensitive data and are used for compliance auditing. Which combination of controls best protects the log interface?

   • AUse TLS for log transmission, authenticate log sources with certificates, and restrict access to the log interface with role-based access control.
   • BEncrypt logs with a shared symmetric key embedded in the application code.
   • CAccept logs over plaintext UDP and rely on network segmentation to protect them.
   • DCompress logs before transmission and store them in a public cloud bucket for easy access.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security architect is reviewing a new protocol for a financial trading system. The protocol allows clients to submit orders and receive confirmations. Which threat modeling technique would be most effective in identifying potential attack vectors against the protocol?

   • AReview the protocol's RFC for compliance with standards.
   • BRun a penetration test against the production system.
   • CPerform a STRIDE analysis on each protocol interaction.
   • DConduct a code review of the protocol implementation.
   Reveal Solution Discussion Select an answer first