Hard Difficulty Questions

The same developer writes, reviews, and deploys the code.

Why wrong: This violates separation of duties.

The QA team is allowed to modify production database records.

Why wrong: QA should not have production write access.

The build server automatically deploys code without human verification.

Why wrong: This lacks the human control element required for separation of duties.

All developers have access to the production environment credentials.

Why wrong: This grants excessive access.

Availability

Why wrong: Availability ensures the service remains reachable.

Non-repudiation

Why wrong: Non-repudiation is about proof of origin, not client identity verification.

Confidentiality

Why wrong: This protects data against unauthorized disclosure, but the client_secret is for authentication.

Integrity

Why wrong: Integrity ensures data hasn't been tampered with.

Granting permanent access to all authenticated users.

Why wrong: This is a violation of the principle.

Checking authorization only at login.

Why wrong: This would allow unauthorized access for the duration of the session.

Relying on the user to request access when needed.

Why wrong: Access must be mediated by the security kernel.

Caching permissions to reduce latency.

Why wrong: Caching can lead to stale permissions and violates complete mediation.

Penetration testing.

Why wrong: Pen testing occurs later in the SDLC.

Incident response planning.

Why wrong: This is an operational activity.

Static code analysis.

Why wrong: This is a post-development or during-development activity.

Elevation of Privilege.

Why wrong: Signatures do not control authorization levels.

Information Disclosure.

Why wrong: Encryption, not signing, prevents disclosure.

Denial of Service.

Why wrong: Signatures do not prevent DoS.

The full password of the user involved in the event.

Why wrong: Never log sensitive credentials.

The user's home address and phone number.

Why wrong: PII should not be in logs unless required.

Centralized database user management.

Why wrong: Does not address service-level authentication or architectural design.

Service Mesh with mutual TLS enabled.

Why wrong: Focuses on network-level security and service discovery.

Sidecar pattern using a local proxy for mTLS.

Why wrong: This secures traffic but does not centralize application-level auth.

The write is permitted.

Why wrong: Writing to a higher level is a 'write-up' which is allowed by the simple security property but restricted by the *-property in specific implementations.

The write is denied due to the no-write-down rule.

Why wrong: The user is writing up, not down.

The system allows the write only if encryption is used.

Why wrong: Bell-LaPadula is a formal model not dependent on specific encryption implementations.

Cross-Site Request Forgery (CSRF).

Why wrong: CSRF is a session-based vulnerability, not a token forging issue.

Broken object-level authorization.

Why wrong: This is a logic error, not a token verification error.

Insecure cookie flags.

Why wrong: JWTs are often stored in local storage, not just cookies.

Storing secret keys as environment variables in the container spec.

Why wrong: Environment variables are easily exposed via monitoring tools.

Running the application process as the root user.

Why wrong: This increases the impact of a container escape.

Using a single large image for all microservices.

Why wrong: This increases the attack surface of each container.

Trust but verify

Why wrong: Zero Trust replaces this with 'Never trust, always verify'.

Trust all internal network traffic

Why wrong: Zero Trust assumes the internal network is just as risky as the external.

Storing secrets in a configuration file within the deployment container.

Why wrong: Containers can be inspected, exposing the secrets.

Requesting secrets from the user at application startup.

Why wrong: This is impractical and disrupts the user experience.

Hard-coding secrets in the source code as encrypted strings.

Why wrong: Code can be decompiled or accidentally leaked in version control.

Increasing the frequency of manual code uploads.

Why wrong: Automation, not manual uploads, is required for pipeline integrity.

Using only open-source libraries without vetting.

Why wrong: This is a major supply chain security risk.

Ensuring all developers have root access to production.

Why wrong: This is a severe security risk.

Increased network latency.

Why wrong: This is an architectural performance issue, not a security risk.

Increased risk of SQL injection.

Why wrong: SQL injection depends on how the query is built, not the service account.

Incompatibility with container orchestrators.

Why wrong: This is not a constraint of container orchestrators.

Role-Based Access Control (RBAC)

Why wrong: RBAC is a general model, not specific to Clark-Wilson's integrity enforcement.

Attribute-Based Access Control (ABAC)

Why wrong: ABAC uses attributes, which is a different access model.

Discretionary Access Control (DAC)

Why wrong: Clark-Wilson is more rigid than DAC.

Security Labels

Why wrong: Labels are used in Bell-LaPadula.

Migrating all legacy data immediately.

Why wrong: This is a project management task, not a security design strategy.

Direct integration via shared database tables.

Why wrong: This exposes the application to the legacy system's flaws directly.

Granting the legacy system full administrative privileges in the new system.

Why wrong: This increases the attack surface significantly.

Using sequentially incrementing IDs (e.g., 1, 2, 3) for all resources.

Why wrong: Sequential IDs are easily guessable.

Relying on the frontend to hide sensitive objects.

Why wrong: Client-side controls are bypassable.

Using base64 encoded strings for all database IDs.

Why wrong: Encoding is not a valid security control.

Encryption

Why wrong: Encryption is a control, not a threat category.

Identification

Why wrong: Identification is not a threat category in STRIDE.

Checking the file size

Why wrong: Size limits prevent DoS, not RCE.

Validating the file extension only

Why wrong: Extensions can be easily spoofed.

Enabling execution permissions on the upload folder

Why wrong: This would facilitate RCE, not prevent it.

Relying solely on the network firewall for all security.

Why wrong: This is a single point of failure.

Allowing all traffic through the API Gateway for performance.

Why wrong: This removes security entirely.