Secure Software Concepts

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

A healthcare SaaS provider must ensure that only authorized clinicians can view patient records, and that any access is logged with a tamper-evident trail. The lead architect proposes implementing role-based access control (RBAC) with digital signatures on audit logs. Which security objective does this combination primarily satisfy?

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

A financial services firm is designing a new mobile banking app. The security team wants to ensure that even if an attacker compromises one component, they cannot easily move laterally to access sensitive customer data. Which secure design principle should be prioritized to limit the blast radius of a compromise?

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

A software architect is designing a system to enforce the principle of least privilege. Which two practices should be implemented to achieve this? (Choose two.)

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

When designing secure software, why is 'Economy of Mechanism' important?

Which of the following is an example of defense-in-depth in a web application architecture?

Which TWO of the following actions support the 'Open Design' security principle?

Which TWO of the following are essential components for achieving 'Non-repudiation'?

A software development team is adopting a secure design principle that requires the security of a system to depend on the secrecy of the keys, not on the secrecy of the algorithm. Which principle are they implementing?

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

Which TWO of the following are examples of how software can maintain 'Integrity'?

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?