Secure Software Architecture And Design

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

You are designing a web application and need to ensure the Principle of Least Privilege is applied to database access. Which approach best satisfies this requirement?

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Which design principle is exemplified by implementing a Web Application Firewall (WAF) to inspect incoming traffic before it hits the application logic?

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

When designing an API, which approach best supports the 'Complete Mediation' principle?

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

Which design activity helps identify security requirements during the earliest phases of the SDLC?

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

You are designing an application that integrates with a legacy system. Which design strategy minimizes the risk of the legacy system's vulnerabilities affecting your application?

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

Which THREE of the following are key components of a 'Secure Design Review' process?

Which TWO of the following strategies best implement the principle of 'Separation of Duties' in an application design?

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

Which TWO of the following design patterns improve the resilience of a secure system?

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?