Requirements and Design CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A software architect proposes a microservices architecture for a new banking application. The security tester is asked to validate the design. Which activity best demonstrates the role of security testing in design?

   • AWait until the code is written to perform a static analysis on the services.
   • BAsk the architect to use a monolithic architecture to simplify security.
   • CReview the architecture to ensure that security controls like authentication and authorization are placed at each service boundary.
   • DCreate a security test plan that only includes penetration testing of the final system.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An architect presents a design for a web application that uses a third-party identity provider (IdP) for authentication. The security tester is asked to analyze the architecture. Which aspect should the tester focus on to analyze the attack surface?

   • ACheck that the IdP uses strong encryption for all communications.
   • BEnsure that the application has a CAPTCHA on the login form.
   • CIdentify all trust boundaries, such as the boundary between the application and the IdP, and the data flows crossing them.
   • DVerify that the IdP is hosted in the same cloud region as the application.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary goal of applying threat modeling during the requirements phase?

   • ATo design the user interface for the application.
   • BTo identify potential threats and vulnerabilities in the requirements.
   • CTo select the programming language for implementation.
   • DTo estimate the cost of security testing.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is developing a mobile banking app. During requirements gathering, the team identifies the following security requirements: biometric authentication, encryption of data in transit, and a feature to remotely wipe the device if lost. The security tester must prioritize these requirements. Which requirement should be given the highest priority based on risk?

   • AAll requirements are equally important and should be prioritized equally.
   • BEncryption of data in transit, because interception of banking data has high impact and likelihood.
   • CRemote wipe, because it is a unique feature that competitors do not offer.
   • DBiometric authentication, because it is a modern feature that users expect.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare startup is building a patient portal that will store protected health information (PHI). During requirements gathering, the product owner insists on a feature that allows patients to share their records with any third-party app via an open API. The security tester is asked to help define requirements. Which action best aligns security testing with the requirements phase?

   • AReject the feature outright because any open API poses an unacceptable risk to PHI.
   • BDocument the open API as a security requirement, specifying authentication, authorization, and audit logging for every third-party access.
   • CDefer all security considerations to the design phase when the architecture is known.
   • DAdd a requirement that all third-party apps must be manually reviewed by legal before access is granted.
   Reveal Solution Discussion Select an answer first