Secure Software Concepts

You are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is the outcome?

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

Which of the following is an example of defense-in-depth in a web application architecture?

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

When designing secure software, why is 'Economy of Mechanism' important?

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

An application utilizes the Clark-Wilson integrity model. Which mechanism does it use to ensure that subjects only perform authorized operations on objects?

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Which TWO of the following are examples of how software can maintain 'Integrity'?

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

Which TWO of the following actions support the 'Open Design' security principle?

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

Which TWO of the following are essential components for achieving 'Non-repudiation'?