Understand Security Design Principles CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which resiliency concept ensures that a system fails in a state that is secure, even if it means denying service?

   • AFail safe
   • BFail secure
   • CFailover
   • DNo single point of failure
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which security control is often criticized for poor psychological acceptability because it imposes a burden on users?

   • AComplex password requirements
   • BSingle sign-on
   • CPasswordless authentication
   • DClear screen layouts
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A development team is building a new application and wants to use a common logging library to standardize logging across the organization. The library is widely used and well-documented. However, the team is concerned about the risk of a vulnerability in the library being exploited. Which action best mitigates this risk?

   • AUse the library but never update it to avoid breaking changes
   • BMonitor the library's security advisories and apply patches promptly
   • CAvoid using the library and write custom logging code
   • DUse the library only if it is open source
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A software company is developing a plugin-based architecture where third-party plugins can be loaded into the main application. The security team is concerned that a malicious plugin could compromise the entire application. Which approach best applies the principle of least common mechanism to mitigate this risk?

   • ARun each plugin in a separate process with limited privileges
   • BDisable plugins by default and require user opt-in
   • CUse a single shared process for all plugins to improve performance
   • DRequire all plugins to be digitally signed by the company
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services firm is deploying a new payment-processing application. The security team requires that no single employee can both initiate a wire transfer and approve it. Additionally, the application must enforce that each employee only has access to the customer records necessary for their current task. Which combination of security design principles should the architect apply?

   • ALeast common mechanism and resiliency
   • BLeast privilege and segregation of duties
   • CDefense in depth and complete mediation
   • DEconomy of mechanism and open design
   Reveal Solution Discussion Select an answer first