Select Two (Multi-Select) Questions

Multi-factor authentication.

Why wrong: Provides authentication, not non-repudiation.

Load balancing.

Why wrong: Provides availability.

Strong encryption of data in transit.

Why wrong: Encryption provides confidentiality, not non-repudiation.

Granting developers full access to production database backups.

Why wrong: Separation of duties usually forbids this.

Using a single shared admin account for all system functions.

Why wrong: This is an anti-pattern.

Allowing a single admin to manage all user accounts.

Why wrong: This violates separation of duties.

Allowing multiple simultaneous sessions for a single user.

Why wrong: This is a functional policy, not inherently a security requirement.

Using long-lived sessions to improve user experience.

Why wrong: Long sessions increase the window of opportunity for attackers.

Storing session tokens in the browser's local storage.

Why wrong: Local storage is vulnerable to XSS.

Elevation of Privilege.

Why wrong: Signatures do not control authorization levels.

Information Disclosure.

Why wrong: Encryption, not signing, prevents disclosure.

Denial of Service.

Why wrong: Signatures do not prevent DoS.

The full password of the user involved in the event.

Why wrong: Never log sensitive credentials.

The user's home address and phone number.

Why wrong: PII should not be in logs unless required.

Only using HTTP for faster communication.

Why wrong: HTTPS is mandatory for security.

Hard-coding the API endpoint URLs in the application.

Why wrong: URLs should be configurable, but hard-coding is not a security best practice.

Writing the final deployment documentation.

Why wrong: This is an operational task.

Performing dynamic analysis on the final build.

Why wrong: Design review happens before final build dynamic analysis.

Non-repudiation

Why wrong: Non-repudiation is not part of the CIA triad.

Accounting

Why wrong: Accounting is not part of the CIA triad.

Authentication

Why wrong: Authentication is a security process, not part of the triad.

Trust but verify

Why wrong: Zero Trust replaces this with 'Never trust, always verify'.

Trust all internal network traffic

Why wrong: Zero Trust assumes the internal network is just as risky as the external.

Increasing the frequency of manual code uploads.

Why wrong: Automation, not manual uploads, is required for pipeline integrity.

Using only open-source libraries without vetting.

Why wrong: This is a major supply chain security risk.

Ensuring all developers have root access to production.

Why wrong: This is a severe security risk.

Hardcoding API keys in the code for efficiency.

Why wrong: This is a security anti-pattern.

Relying solely on the WAF for security.

Why wrong: Defense in depth requires controls at multiple layers.

Allowing all traffic on port 80 for compatibility.

Why wrong: This violates secure design principles.

Security through obscurity.

Why wrong: This is an anti-pattern.

Hard-coding credentials for quick recovery.

Why wrong: Hard-coding is a security risk.

Using sequentially incrementing IDs (e.g., 1, 2, 3) for all resources.

Why wrong: Sequential IDs are easily guessable.

Relying on the frontend to hide sensitive objects.

Why wrong: Client-side controls are bypassable.

Using base64 encoded strings for all database IDs.

Why wrong: Encoding is not a valid security control.

Keeping the API endpoint documentation private.

Why wrong: This is not related to open design.

Hiding the source code from all development team members.

Why wrong: This does not aid in security design analysis.

Using a proprietary, secret encryption algorithm.

Why wrong: This is 'security through obscurity', which is discouraged.

Encryption

Why wrong: Encryption is a control, not a threat category.

Identification

Why wrong: Identification is not a threat category in STRIDE.

Encrypting data at rest using AES.

Why wrong: Encryption primarily addresses confidentiality.

Ensuring the server is always online.

Why wrong: This is availability.

Forcing users to change passwords regularly.

Why wrong: This is related to authentication.

Relying solely on the network firewall for all security.

Why wrong: This is a single point of failure.

Allowing all traffic through the API Gateway for performance.

Why wrong: This removes security entirely.

Use cleartext headers for all communication

Why wrong: Incorrect - headers should be encrypted.

Expose full internal database schemas

Why wrong: Incorrect - creates security risks.

Disabling all security logging to prevent alert fatigue.

Why wrong: Logging is critical for detecting zero-day exploitation.

Relying solely on perimeter-based firewalls for security.

Why wrong: Perimeter security is insufficient for internal or zero-day threats.

Updating the application to the latest version once per year.

Why wrong: Annual updates are insufficient for modern security threats.

Log every single user mouse movement

Why wrong: Incorrect - creates excessive noise and potential privacy issues.

Send logs to a publicly accessible bucket

Why wrong: Incorrect - logs contain sensitive information.

Disable all logging to improve performance

Why wrong: Incorrect - logging is critical for auditing.