CCNA Secure Software Architecture And Design Questions

Broken access control arises when authorisation decisions rely on client-side checks or per-endpoint logic that can be bypassed. Centralised server-side enforcement validates every request against policy, satisfying the design mitigation requirement by removing client trust and inconsistent per-route checks.

This approach directly implements least privilege by granting only the permissions required for a user's role and periodically validating that those permissions remain appropriate. It limits the blast radius of compromised accounts and reduces the risk of privilege abuse. Regular reviews ensure that permissions do not accumulate over time, which is a common failure mode in role-based access control systems.

AES-256-GCM provides strong confidentiality and integrity, and using a unique key per record limits the impact of a key compromise. Storing keys in an HSM protects them from extraction and ensures secure key management. This approach aligns with HIPAA's encryption requirements and best practices for protecting ePHI at rest, as it combines robust encryption with secure key storage.

A service mesh with mTLS ensures that each service authenticates to others using certificates, and authorization policies at the sidecar proxy enforce least privilege. This design provides strong identity and access control at the network layer, preventing lateral movement because a compromised service cannot impersonate another without valid certificates. The sidecar proxy intercepts all traffic, enabling consistent policy enforcement and detailed audit logging, which is ideal for microservices.

A digital signature provides integrity and authenticity. If the payload is modified in transit, the signature verification will fail because the hash no longer matches. TLS only protects the message while in transit between immediate hops; once the message is stored in the queue, TLS does not protect it. Signing the payload ensures end-to-end integrity regardless of intermediate storage.

A read-only root filesystem prevents an attacker who compromises a container from writing malware, altering binaries or persisting changes to the image layers. This contains the breach to the running container's ephemeral state, minimising impact within the cloud-native environment.

For tokenization to reduce PCI DSS scope, the sensitive card data must be isolated from the application environment. Hosting the tokenization service in a separate segment and ensuring the application never handles raw card data means the application falls outside the cardholder data environment (CDE). This minimizes the systems that need to be PCI DSS compliant, which is the primary goal of tokenization.

A service mesh with mTLS encrypts and authenticates all service-to-service communication, and fine-grained access policies enforce least privilege between services. This segmentation limits lateral movement because a compromised service cannot freely communicate with others without proper authorization. The service mesh also provides observability and policy enforcement, making it a robust pattern for containing breaches in microservices architectures.

Data masking ensures that cardholder data is not exposed in the user interface or logs. Displaying only the last four digits of the PAN is a common PCI DSS requirement. Masking other sensitive data prevents accidental leakage through screenshots, logs, or shoulder surfing. This design principle protects data in use and helps meet compliance requirements for display of cardholder data.

Whitelisting, or positive validation, defines exactly what is allowed and rejects everything else. This is highly effective against injection attacks because it prevents malicious characters or patterns from being processed. It is a robust design approach that minimizes the attack surface and is recommended by security standards for input validation.

A dedicated secret management service stores credentials centrally, encrypts them at rest, enforces access policies and audits retrieval. Injecting secrets at runtime keeps them out of source code, build artefacts and container images, eliminating hard-coded credential exposure — the most secure pattern for the stated requirement.

Using hardware-backed key storage ensures that the encryption key is protected by dedicated security hardware, making it extremely difficult to extract even if the device is compromised. Storing the encrypted data in the app's private directory prevents other apps from accessing it. This design provides strong confidentiality for data at rest and protects against unauthorized access, meeting the requirements for lost/stolen devices and inter-app isolation.

Moving the secret to a server-side broker places it inside a trust boundary the attacker does not control. The client authenticates to your own backend using a credential appropriate to a public client, and the backend holds the vendor secret and makes the privileged call. This removes the secret from the untrusted environment entirely, which is the correct architectural fix.

Disabling unused services and ports shrinks the attack surface, so nothing unnecessary listens for connections. This directly enforces secure-by-default: the production container image exposes only what the application genuinely requires, eliminating latent entry points attackers could exploit.

Digital signatures provide integrity and origin authentication by hashing the message payload and encrypting that hash with the sender's private key, so any modification is detectable on verification. This directly satisfies the SOA requirement that messages between services are not tampered with, unlike transport-only protections that leave payloads exposed once decrypted.

Random, non-predictable UUIDs prevent attackers from enumerating or guessing valid resource identifiers, removing the predictable-ID precondition BOLA exploits. This satisfies the stem's design-choice constraint by making object references unguessable, so unauthorised direct object access attempts cannot target known IDs.

Threat modeling is a structured approach to identify potential threats and security requirements during the design phase. By analyzing data flows, trust boundaries, and potential attack vectors, the team can define security controls early, reducing the cost of remediation later. It aligns with the CSSLP principle of building security in from the start and is a core activity in secure software design.

This is correct because the plaintext DEK never persists in storage; only the wrapped DEK and ciphertext do. An attacker with bucket read access cannot unwrap the DEK without the KMS KEK, and KMS access is separately authenticated and audited. Per-record DEKs also limit the blast radius of any single key compromise.

Abuse case modelling examines how an attacker could misuse the application, deriving security requirements from anticipated threats during the earliest SDLC phases. Unlike functional use cases, it explicitly captures adversarial goals, feeding concrete protective requirements into design before code is written.

Memory-safe languages eliminate entire classes of flaws such as buffer overflows and use-after-free at the source. Isolating unavoidable native code behind a small, validated boundary limits the blast radius of any residual flaw, which is precisely the containment and early-detection goal stated in the scenario.

Row-level security enforces tenant isolation in the data layer, so even if a developer forgets a WHERE clause, the database will not return another tenant's rows. This provides a defense-in-depth control that does not depend on application code discipline. It aligns with the architectural goal of enforcing a security constraint centrally rather than per-query.

Splitting deployment approval across two distinct roles prevents any single individual from both writing and releasing code, enforcing the dual-control requirement central to separation of duties. It directly satisfies the stem by ensuring no one holds end-to-end authority over the production change.

Validating the architecture against established security patterns confirms the design implements proven controls rather than ad hoc measures, satisfying the review's requirement to assess whether the proposed structure meets the organisation's security standards before code is written.

A shared service account removes per-service identity, so database audit logs cannot attribute actions to a specific microservice. This destroys accountability and makes forensic reconstruction of which service performed a malicious or erroneous action effectively impossible.

Fail-safe defaults deny access when a decision cannot be evaluated, so a component failure or malformed input cannot silently grant privileges. This directly satisfies the stem's resilience constraint by keeping the system secure under fault conditions rather than depending on every check completing successfully.

Per-service workload identity with short-lived, narrowly scoped credentials is the core of least privilege in a microservices mesh. If one service is compromised, the attacker inherits only that service's permissions and only until the credential expires. This directly limits lateral movement and blast radius, which is exactly the design objective stated in the scenario.

Economy of mechanism holds that security functions should be as simple as possible, since complexity breeds implementation errors and overlooked flaws. Keeping designs small and understandable makes them easier to verify, test and maintain, directly satisfying the stem's requirement that developers keep security mechanisms simple to understand and implement.

Pseudonymization replaces direct identifiers with artificial identifiers, reducing the linkability of data to individuals. This supports data minimization by limiting the exposure of personal data in secondary uses like analytics and logging. It is a privacy-enhancing technique that aligns with the principle of using only the data necessary for the purpose, making it a correct choice.

Redundancy with automatic failover ensures that if one component fails, another can take over, maintaining availability. This is a core principle of resilience, as it reduces single points of failure and allows the system to continue operating during disruptions. It also helps mitigate denial-of-service attacks by providing additional capacity and failover paths.

Validating input at multiple layers ensures that if one layer is bypassed or has a flaw, another layer can still catch malicious input. This is a classic defense-in-depth approach: redundant controls that address the same threat from different angles. It reduces the likelihood of a single point of failure leading to a vulnerability.

Fail-safe defaults means access decisions fall back to denial when the module cannot complete its checks. A login error therefore refuses entry rather than granting it, satisfying the stem's requirement that the authentication module default to a secure state under failure.

An abstraction layer intercepts every call to the legacy system, validating and sanitising data in both directions. This isolates your application from the legacy system's vulnerabilities, such as injection flaws, so a compromise there cannot propagate across the boundary — directly minimising the risk the stem describes.

External API credentials grant access to third-party services and often carry billing or data-scope privileges. Storing them in a secure vault rather than source code or configuration files enforces confidentiality and controlled retrieval, satisfying the need to protect secrets from disclosure or unauthorised reuse.

Using a hardware-backed keystore ensures that sensitive tokens are encrypted and protected by the device's secure element, making extraction difficult even with physical access. Requiring user authentication adds a layer of protection. This aligns with the principle of securing data at rest and leveraging platform security features, which is a best practice for mobile banking applications.

This approach grants only the permissions necessary for the portal to function, which is the essence of least privilege. If the account is compromised, the attacker cannot access unrelated tables or perform administrative actions. It limits the potential damage and aligns with secure design principles.

Sender-constrained tokens are useless to an attacker who copies them without the corresponding private key, which is stored in hardware-backed keystore and ideally non-exportable. Rotation on each use also detects replay, because a reused token invalidates the chain, giving the defender a signal of compromise.

Context-aware output encoding neutralises injected markup at the exact point of rendering, matching each sink (HTML, attribute, JavaScript, URL). This defeats XSS regardless of how input bypassed earlier filtering, satisfying the presentation-layer defence the scenario requires.

Classifying data sensitivity determines the protection level each asset warrants, driving selection of encryption, access control and handling requirements proportionate to impact. This satisfies the stem's goal of linking sensitivity classification to the controls and protection levels applied to specific data assets.

With a shared schema and tenant column, isolation is enforced only by application-layer predicates. Any missed WHERE clause, ORM bypass, ad-hoc report query, or new developer mistake leaks cross-tenant data. There is no database-enforced boundary acting as a backstop, so a single coding error becomes a multi-tenant breach, which is precisely the systemic risk a security architect must flag in this design.

When the verifier accepts alg: none, it treats the token as valid without checking any signature, so an attacker can alter claims such as role or subject and forge arbitrary tokens. This is signature bypass, satisfying the stem's stateless authentication scenario.

HttpOnly prevents client-side scripts from reading session cookies, while Secure restricts transmission to encrypted channels, so reviewing these flags directly exposes cookie theft and interception weaknesses. This inspection targets the exact session management controls the review must assess.

Digital signatures provide non-repudiation by cryptographically binding a signer's private key to the message, so the signer cannot later deny authorship. This directly mitigates STRIDE's Repudiation category, which covers denying performing an action. Verification with the signer's public key proves origin and integrity, satisfying the stem's requirement.

An API Gateway terminates authentication centrally, validating tokens before routing to microservices, which then trust the gateway's assertions. This decouples identity logic from each service, satisfying the centralised-authentication requirement without embedding credentials handling in every microservice.

Recording the action type — for example read, write, delete, or login — establishes what operation occurred, which is essential for reconstructing events during an audit. Without it, log entries show only who and when, leaving the nature of the activity unverifiable and accountability incomplete.

Complete Mediation demands that every access attempt be checked against policy, with no caching of prior decisions. Verifying authorisation on each API request satisfies this by preventing bypass through reused sessions or assumed trust, ensuring no request reaches protected resources unchecked.

A strict CSP with nonces or hashes and no inline script blocks the most common injection vectors that would run attacker code in the page. Combined with in-memory token storage, it addresses both the injection and the credential-theft halves of the threat, which is why it belongs in the design rather than as a later hardening step.

Isolating the library in a separate process with least privilege limits the impact of a zero-day exploit. If the parser is compromised, the attacker gains only the privileges of that process, not the entire application. The restricted interface further reduces the attack surface. This is a sandboxing approach that contains the blast radius.

The HttpOnly flag blocks JavaScript access to the session cookie, mitigating XSS-based theft, while Secure restricts transmission to HTTPS, preventing interception over cleartext channels. Together they harden the cookie itself, a core session management control.

Mutual TLS authenticates both client and server at the transport layer, so a compromised credential or spoofed endpoint still fails the handshake. This adds an independent control layer beyond tokens or gateway checks, satisfying defense in depth by ensuring no single authentication failure grants API access.

Row-level security policies in the database enforce tenant isolation at the data layer, ensuring that every query is automatically filtered by tenant ID. This prevents accidental cross-tenant access even if application code has flaws, because the database itself enforces the boundary. It supports a shared schema and single logical database while maintaining strong isolation.