scenario questions

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

A financial services firm is designing a new web application that will allow customers to transfer funds between accounts. The security architect has mandated that the application must enforce the principle of 'least privilege' for all user actions. Which design approach best achieves this?

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

A healthcare organization is designing a system to store and process electronic protected health information (ePHI). The system must comply with HIPAA and ensure data confidentiality at rest. Which cryptographic design choice is most appropriate?

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Which THREE factors should be considered when prioritizing findings from a DAST scan?

A company is designing a microservices-based e-commerce platform. The security team wants to ensure that if one microservice is compromised, the attacker cannot easily move laterally to other services. The design must enforce least privilege and provide strong authentication and authorization between services. Which design pattern best achieves these goals?

To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

A healthcare SaaS provider must ensure that only authorized clinicians can view patient records, and that any access is logged with a tamper-evident trail. The lead architect proposes implementing role-based access control (RBAC) with digital signatures on audit logs. Which security objective does this combination primarily satisfy?

A software company is developing a cloud-based collaboration platform that will be used by government agencies. The platform must adhere to FedRAMP requirements. The security team is defining security requirements and needs to ensure that data in transit is protected. Which of the following requirements is MOST appropriate to include in the security requirements specification to meet FedRAMP requirements?

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

A software architect is designing a system that processes credit card payments. The design must comply with PCI DSS requirements for protecting cardholder data. The architect decides to use a tokenization service to replace sensitive card data with non-sensitive tokens. Which design consideration is most critical to ensure the tokenization solution effectively reduces the scope of PCI DSS compliance?

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

A company is designing a microservices-based e-commerce platform. The security team wants to ensure that if one microservice is compromised, the attacker cannot easily move laterally to other services. Which design pattern best addresses this concern?

A software architect is designing a new web application that will handle credit card transactions. The design must ensure that the application does not store sensitive authentication data after authorization, and that any display of cardholder data is masked. Which two design principles should be applied to meet these requirements? (Choose two.)

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Which TWO of the following are crucial when performing a manual code review for security?

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

A software architect is designing a component that will process untrusted input from external sources. To prevent injection attacks, the architect decides to implement input validation. Which design approach for input validation is most effective at mitigating injection flaws?

A software vendor provides a critical component to your organization. During contract negotiations, you request that the vendor provide a Software Bill of Materials (SBOM) for each release. The vendor agrees to provide a document listing all open-source libraries and their versions. Which additional attribute is most important to include in the SBOM to support rapid vulnerability response?

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

A software development team is designing a new mobile application that will store sensitive personal data on the device. The security architect must ensure that the data remains confidential even if the device is lost or stolen, and that the data is protected against unauthorized access by other applications on the same device. Which design approach best meets these requirements?

A financial services firm is designing a new mobile banking app. The security team wants to ensure that even if an attacker compromises one component, they cannot easily move laterally to access sensitive customer data. Which secure design principle should be prioritized to limit the blast radius of a compromise?

When designing a test case for secure API authentication, which THREE elements should be included?

Which TWO of the following represent common output formats for security testing reports?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

A development team is designing a desktop application that must call a third-party payment API. The vendor requires the application to prove its identity to the API using a shared secret. A junior engineer proposes embedding the secret directly in the compiled client binary. The security architect must recommend a design change. Which approach best addresses the underlying design flaw?

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Which TWO of the following practices are recommended when performing fuzz testing on a web service?

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

A developer is implementing a file upload feature in a web application. The application must allow users to upload images but prevent the execution of malicious scripts. The developer decides to validate the file extension and MIME type. Which additional security control is most effective to prevent stored cross-site scripting (XSS) via uploaded files?

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

You are auditing your software deployment process. Which practice is best to prevent 'Dependency Confusion' attacks where malicious packages are pulled from public registries instead of internal ones?

You are leading a secure software initiative at a mid-sized fintech company. The development teams have adopted an Agile methodology with two-week sprints, and management wants to ensure that security activities are integrated into the development process without slowing down delivery. Which of the following is the MOST effective approach to integrate security into the Agile lifecycle?

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

A software development team is beginning a new project and wants to integrate security into the design phase. Which activity is most effective for identifying potential security requirements early in the software development lifecycle (SDLC)?

A healthcare SaaS provider is designing a new document-sharing feature for its patient portal. Clinicians upload sensitive records that must be readable only by the patient and the assigned care team, even if an attacker later gains read access to the storage bucket. The architect decides to implement envelope encryption using a cloud KMS. Which design decision best ensures that a storage-bucket compromise does not expose plaintext records?

Which design activity helps identify security requirements during the earliest phases of the SDLC?

Which of the following is a key component of a 'Secure Software Deployment' plan?

A developer is writing code that handles sensitive cryptographic keys. The keys must be protected from unauthorized access. Which practice is most appropriate for securing cryptographic keys in the application?

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

A software team is designing a new employee scheduling application. The architect wants to ensure that if a developer accidentally introduces a memory-safety flaw, the impact is contained and the flaw is detected before release. Which design decision best supports this goal at the architecture level?

A security analyst is reviewing the results of a dynamic application security testing (DAST) scan against a REST API. The scan report includes several findings, but the analyst must prioritize remediation. Which two factors are most important to consider when triaging DAST findings for an API? (Choose two.)

A software architect is designing a multi-tenant SaaS application that must prevent a user from one tenant from accessing another tenant's data through the application's API. The architect wants to enforce this isolation at the architectural level rather than relying on developers to remember to include a tenant filter in every query. Which design approach best achieves this goal?

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Which THREE categories are typically used to classify security requirements?

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

A security architect is reviewing the design of a new web application. The application must ensure that session identifiers are unpredictable and resistant to guessing attacks. The development team proposes using a random number generator. Which approach should the architect recommend to meet this requirement?

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Which document is essential to map regulatory compliance requirements to specific software features?

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

When evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?

Which TWO factors are critical when identifying compliance requirements for software that processes cross-border financial transactions?

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Which THREE of the following are common threats to the Software Supply Chain that an SBOM can help mitigate?

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

Which TWO of the following strategies best implement the principle of 'Separation of Duties' in an application design?

Which THREE of the following are key components of a 'Secure Design Review' process?

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

A security analyst notices anomalous outbound traffic from a containerized microservice that was recently deployed. Which Kubernetes feature should be used to restrict this traffic to only known authorized endpoints?

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Which TWO of the following design patterns improve the resilience of a secure system?

A software architect is designing a system to enforce the principle of least privilege. Which two practices should be implemented to achieve this? (Choose two.)

A retail company runs a payment microservice in production. During a security review, the team must confirm that the service can detect and respond to anomalous administrative actions in near real time. The service runs on a container platform and writes structured events to a central log store. Which practice best ensures that administrative actions are detected and acted upon promptly?

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

A software development team is adopting a Secure Software Lifecycle (S-SDLC) process. They have defined security requirements, performed threat modeling, and are now in the implementation phase. Which of the following activities is MOST critical during the implementation phase to ensure secure code?

A financial services firm is designing a new internal microservices platform. The architecture team wants to reduce the blast radius of a compromised service account while still allowing services to authenticate to one another. Which TWO design measures best support this goal? (Choose two.)

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

You are the security lead for a healthcare software product that must comply with HIPAA. The organization is adopting a DevSecOps model and wants to ensure that security is measured and improved continuously. Which TWO of the following metrics are MOST appropriate for tracking the effectiveness of the secure software lifecycle management process? (Choose two.)

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

Which standard security practice should be applied to all passwords stored in a database?

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

A software development team is designing a new web application that will handle sensitive personal data. The security architect recommends incorporating privacy by design principles. Which two design practices best align with the principle of data minimization? (Choose two.)

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Which THREE factors must be considered when defining 'Compliance Requirements' for an international software product?

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

A software architect is designing a system that must be resilient to failures and attacks. Which two design principles best contribute to system resilience? (Choose two.)

When designing secure software, why is 'Economy of Mechanism' important?

A security architect is designing a new web application that will handle sensitive customer data. The architect wants to incorporate the principle of 'defense in depth' into the architecture. Which TWO of the following design decisions best exemplify defense in depth? (Choose two.)

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

You are eliciting security requirements for a new online banking application. The business stakeholders are focused on features and have limited security knowledge. You need to ensure that security requirements are complete, unambiguous, and testable. Which technique is MOST appropriate to achieve this?

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Which of the following is an example of defense-in-depth in a web application architecture?

Which THREE of the following are best practices for the secure use of third-party libraries?

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Which THREE configuration management practices help reduce 'Configuration Drift' in a secure software environment?

You are designing an application that integrates with a legacy system. Which design strategy minimizes the risk of the legacy system's vulnerabilities affecting your application?

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

A financial services firm is designing a new mobile banking application. The security architect wants to ensure that if an attacker gains physical access to a user's device, they cannot easily extract sensitive session tokens stored by the app. Which secure design principle should be applied to protect these tokens at rest?

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

When managing infrastructure as code (IaC) using Terraform, which practice is the most critical for secure configuration management of state files?

A software development team is designing a new internal employee portal. The security architect recommends implementing the principle of least privilege. Which design decision best applies this principle to the portal's database access?

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

A retail company is designing a mobile application that stores a long-lived refresh token on the device so users stay signed in. The security architect is concerned that a stolen device or a rooted device could yield the token to an attacker. Which design choice best limits the usefulness of a stolen refresh token?

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

A healthcare SaaS provider is designing a multi-tenant web application where each hospital customer's data must remain logically isolated. The design team proposes using a single shared database schema with a tenant identifier column on every table, enforced by application-layer query filters. A security architect must evaluate this proposal. Which design concern is the MOST significant risk with this approach?

Your organization is adopting the SLSA framework to improve supply chain security. You are evaluating a build system that claims to meet SLSA level 3. During an assessment, you find that the build system generates provenance but does not sign it, and the provenance is stored on the same server that performs builds. Which SLSA level requirement is most directly violated by this finding?

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

Which TWO of the following actions support the 'Open Design' security principle?

A financial services firm is rolling out a new release of its customer portal. The release includes updated third-party libraries and a modified container base image. Before promoting the build to production, the release manager must ensure the integrity and provenance of the artifacts. Which action best provides verifiable provenance and tamper detection for the container image?

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

You are a security architect at a company that develops a widely used mobile banking application. The development team uses a third-party open-source library for encryption. A critical vulnerability is disclosed in that library. What is the MOST effective first step to manage this risk within the secure software lifecycle?

Which TWO of the following are essential components for achieving 'Non-repudiation'?

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

You are a security analyst tasked with reviewing a set of security requirements for a new web application. One requirement states: 'The application must be secure.' What is the PRIMARY issue with this requirement?

A software development team is adopting a secure design principle that requires the security of a system to depend on the secrecy of the keys, not on the secrecy of the algorithm. Which principle are they implementing?

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

A development team is implementing input validation for a web application. They want to ensure that all user-supplied data is properly sanitized to prevent injection attacks. Which TWO of the following are effective techniques for input validation? (Choose two.)

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

Which TWO inputs are most important when developing 'Abuse Cases'?

You are designing a secure software supply chain for a healthcare application that must comply with FDA premarket cybersecurity guidance. Your team proposes using the OWASP Dependency-Check tool within the CI pipeline to identify vulnerable third-party libraries. Which TWO additional practices are essential to establish a defensible component governance process that meets regulatory expectations? (Choose two.)

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

Which THREE of the following practices contribute to secure configuration of a web server?

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

When designing an API, which approach best supports the 'Complete Mediation' principle?

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

Which TWO of the following are common challenges when implementing IAST?

A team is designing a browser-based single-page application that will call backend microservices directly from the client. The security architect wants to reduce the risk that a malicious script injected into the page can silently perform privileged actions on behalf of a logged-in user. Which TWO design choices best reduce this risk? (Choose two.)

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

A software architect is designing a system that uses a third-party library to parse complex file formats. The library has had several critical vulnerabilities in the past. The architect wants to reduce the risk of a zero-day vulnerability in the library compromising the entire application. Which design approach best mitigates this risk?

You are leading a requirements elicitation session for a new EHR system. A stakeholder from the legal department insists that the system must comply with HIPAA. Another stakeholder from the clinical team wants quick access to patient records for emergency situations. You need to document a security requirement that balances these needs. Which requirement BEST addresses both compliance and usability?

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

Which TWO of the following are required to successfully implement a secure logging mechanism?

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

A software development team is adopting a secure software testing strategy. They want to ensure that security testing is performed continuously and that feedback is provided to developers as early as possible. Which testing approach best aligns with this goal?

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

You are a security architect for a FinTech startup building a mobile payment app. The product owner has provided a list of functional user stories but no security requirements. You need to integrate security into the Agile development process without disrupting the sprint cadence. Which approach BEST ensures security requirements are identified and documented continuously?

A security tester is performing interactive application security testing (IAST) on a Java web application. The IAST agent is deployed in the test environment and instruments the application during automated functional tests. The tester notices that the IAST tool reports a high number of false positives for SQL injection. What is the most likely cause of these false positives?

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

A healthcare software development team is building a patient portal that must comply with HIPAA. The team has completed a risk assessment and identified several potential threats. They now need to translate these findings into actionable security requirements. Which of the following is the MOST effective approach to ensure that the security requirements adequately address the identified risks?

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

When performing automated security testing, which of the following is considered a 'false positive'?

Which THREE actions are essential for ensuring a secure Incident Response process for deployed software?

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

A security engineer at a healthcare SaaS provider is planning the disposal of decommissioned application servers that hosted an electronic health records system. The servers held encrypted databases and application logs. Which action best satisfies secure decommissioning requirements for the data at rest on these disks while preserving the ability to repurpose the hardware internally?

Which of the following describes the purpose of 'misuse case' modeling?

A financial services firm mandates that every open-source component pulled into its build pipeline must carry a cryptographically signed provenance attestation from the original project maintainer. During a review, you discover that Sigstore's cosign verification succeeds, but the attestation was generated by an internal CI runner rather than the upstream maintainer. What is the most significant supply chain risk introduced by this configuration?

Which TWO of the following are examples of how software can maintain 'Integrity'?

A software development team is creating a new e-commerce application. During requirements elicitation, the security architect suggests using misuse cases to identify security requirements. Which of the following BEST describes the primary purpose of misuse cases in this context?

What is the primary security benefit of using a hardened container base image for microservices?

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Which TWO of the following practices are key components of a robust Software Security Governance framework?

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

A healthcare SaaS provider is designing a multi-tenant system where each tenant's data is stored in a shared database. To prevent one tenant from accessing another tenant's records, the design team decides to enforce isolation at the data-access layer. Which secure design approach best ensures tenant isolation while maintaining a single logical database?

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Which TWO actions should be taken when preparing a software build for a secure production deployment?

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?