Secure Software Concepts

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

Which of the following is an example of defense-in-depth in a web application architecture?

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

When designing secure software, why is 'Economy of Mechanism' important?

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Which TWO of the following are examples of how software can maintain 'Integrity'?

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

Which TWO of the following actions support the 'Open Design' security principle?

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

Which TWO of the following are essential components for achieving 'Non-repudiation'?

A healthcare SaaS provider must ensure that only authorized clinicians can view patient records, and that any access is logged with a tamper-evident trail. The lead architect proposes implementing role-based access control (RBAC) with digital signatures on audit logs. Which security objective does this combination primarily satisfy?

A financial services firm is designing a new mobile banking app. The security team wants to ensure that even if an attacker compromises one component, they cannot easily move laterally to access sensitive customer data. Which secure design principle should be prioritized to limit the blast radius of a compromise?

A software development team is adopting a secure design principle that requires the security of a system to depend on the secrecy of the keys, not on the secrecy of the algorithm. Which principle are they implementing?

A software architect is designing a system to enforce the principle of least privilege. Which two practices should be implemented to achieve this? (Choose two.)