Secure Software Architecture And Design

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

A financial services firm is designing a new web application that will allow customers to transfer funds between accounts. The security architect has mandated that the application must enforce the principle of 'least privilege' for all user actions. Which design approach best achieves this?

A healthcare organization is designing a system to store and process electronic protected health information (ePHI). The system must comply with HIPAA and ensure data confidentiality at rest. Which cryptographic design choice is most appropriate?

A company is designing a microservices-based e-commerce platform. The security team wants to ensure that if one microservice is compromised, the attacker cannot easily move laterally to other services. The design must enforce least privilege and provide strong authentication and authorization between services. Which design pattern best achieves these goals?

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

A software architect is designing a system that processes credit card payments. The design must comply with PCI DSS requirements for protecting cardholder data. The architect decides to use a tokenization service to replace sensitive card data with non-sensitive tokens. Which design consideration is most critical to ensure the tokenization solution effectively reduces the scope of PCI DSS compliance?

A company is designing a microservices-based e-commerce platform. The security team wants to ensure that if one microservice is compromised, the attacker cannot easily move laterally to other services. Which design pattern best addresses this concern?

A software architect is designing a new web application that will handle credit card transactions. The design must ensure that the application does not store sensitive authentication data after authorization, and that any display of cardholder data is masked. Which two design principles should be applied to meet these requirements? (Choose two.)

A software architect is designing a component that will process untrusted input from external sources. To prevent injection attacks, the architect decides to implement input validation. Which design approach for input validation is most effective at mitigating injection flaws?

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

A software development team is designing a new mobile application that will store sensitive personal data on the device. The security architect must ensure that the data remains confidential even if the device is lost or stolen, and that the data is protected against unauthorized access by other applications on the same device. Which design approach best meets these requirements?

A development team is designing a desktop application that must call a third-party payment API. The vendor requires the application to prove its identity to the API using a shared secret. A junior engineer proposes embedding the secret directly in the compiled client binary. The security architect must recommend a design change. Which approach best addresses the underlying design flaw?

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

A software development team is beginning a new project and wants to integrate security into the design phase. Which activity is most effective for identifying potential security requirements early in the software development lifecycle (SDLC)?

A healthcare SaaS provider is designing a new document-sharing feature for its patient portal. Clinicians upload sensitive records that must be readable only by the patient and the assigned care team, even if an attacker later gains read access to the storage bucket. The architect decides to implement envelope encryption using a cloud KMS. Which design decision best ensures that a storage-bucket compromise does not expose plaintext records?

Which design activity helps identify security requirements during the earliest phases of the SDLC?

A software team is designing a new employee scheduling application. The architect wants to ensure that if a developer accidentally introduces a memory-safety flaw, the impact is contained and the flaw is detected before release. Which design decision best supports this goal at the architecture level?

A software architect is designing a multi-tenant SaaS application that must prevent a user from one tenant from accessing another tenant's data through the application's API. The architect wants to enforce this isolation at the architectural level rather than relying on developers to remember to include a tenant filter in every query. Which design approach best achieves this goal?

Which TWO of the following strategies best implement the principle of 'Separation of Duties' in an application design?

Which THREE of the following are key components of a 'Secure Design Review' process?

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Which TWO of the following design patterns improve the resilience of a secure system?

A financial services firm is designing a new internal microservices platform. The architecture team wants to reduce the blast radius of a compromised service account while still allowing services to authenticate to one another. Which TWO design measures best support this goal? (Choose two.)

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

A software development team is designing a new web application that will handle sensitive personal data. The security architect recommends incorporating privacy by design principles. Which two design practices best align with the principle of data minimization? (Choose two.)

A software architect is designing a system that must be resilient to failures and attacks. Which two design principles best contribute to system resilience? (Choose two.)

A security architect is designing a new web application that will handle sensitive customer data. The architect wants to incorporate the principle of 'defense in depth' into the architecture. Which TWO of the following design decisions best exemplify defense in depth? (Choose two.)

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

You are designing an application that integrates with a legacy system. Which design strategy minimizes the risk of the legacy system's vulnerabilities affecting your application?

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

A financial services firm is designing a new mobile banking application. The security architect wants to ensure that if an attacker gains physical access to a user's device, they cannot easily extract sensitive session tokens stored by the app. Which secure design principle should be applied to protect these tokens at rest?

A software development team is designing a new internal employee portal. The security architect recommends implementing the principle of least privilege. Which design decision best applies this principle to the portal's database access?

A retail company is designing a mobile application that stores a long-lived refresh token on the device so users stay signed in. The security architect is concerned that a stolen device or a rooted device could yield the token to an attacker. Which design choice best limits the usefulness of a stolen refresh token?

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

A healthcare SaaS provider is designing a multi-tenant web application where each hospital customer's data must remain logically isolated. The design team proposes using a single shared database schema with a tenant identifier column on every table, enforced by application-layer query filters. A security architect must evaluate this proposal. Which design concern is the MOST significant risk with this approach?

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

When designing an API, which approach best supports the 'Complete Mediation' principle?

A team is designing a browser-based single-page application that will call backend microservices directly from the client. The security architect wants to reduce the risk that a malicious script injected into the page can silently perform privileged actions on behalf of a logged-in user. Which TWO design choices best reduce this risk? (Choose two.)

A software architect is designing a system that uses a third-party library to parse complex file formats. The library has had several critical vulnerabilities in the past. The architect wants to reduce the risk of a zero-day vulnerability in the library compromising the entire application. Which design approach best mitigates this risk?

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

A healthcare SaaS provider is designing a multi-tenant system where each tenant's data is stored in a shared database. To prevent one tenant from accessing another tenant's records, the design team decides to enforce isolation at the data-access layer. Which secure design approach best ensures tenant isolation while maintaining a single logical database?