CCNA Secure Software Concepts Questions

Least privilege requires granting only the permissions needed for a task. A dedicated service account with granular database permissions avoids shared, over-privileged credentials, limiting blast radius if compromised and satisfying the constraint that database access be scoped to exactly what the application requires.

Accountability ensures that every action can be traced to a responsible entity. RBAC restricts access to authorized clinicians, and tamper-evident audit logs record who accessed what and when. Together, they provide the ability to hold users responsible for their actions. Digital signatures on logs add integrity, preventing undetected modification. This directly satisfies the requirement that access is logged with a tamper-evident trail.

PoLP grants each user, process or service only the permissions required to complete its defined task, nothing more. This directly satisfies the stem's goal by shrinking the attack surface and limiting blast radius, since compromised accounts cannot reach unrelated systems or data beyond their task scope.

Splitting commit and deployment across two identities enforces separation of duties: the developer who authors code cannot also push it to production. This directly satisfies the policy's constraint that no single principal holds both write and release privileges, preventing unilateral changes from reaching production without a second authorised actor.

Integrity is one of the three core CIA triad pillars, ensuring data remains accurate and unaltered unless modified by authorised parties. The stem asks for recognised triad components, and integrity is explicitly named in the acronym itself, making it a definitive member.

Isolation and compartmentalization involve dividing a system into separate components with controlled interfaces, so a compromise in one does not automatically grant access to others. In a mobile banking app, this could mean isolating the authentication module from the data storage module, using sandboxes, or enforcing network segmentation. This directly limits lateral movement and reduces the blast radius, matching the security team's goal.

Complete Mediation requires that every access to every object be authorised at the time of the request, with no reliance on cached decisions or assumed trust. Checking authorisation for every access request directly implements this, closing gaps where prior approval might be reused improperly.

Fail-safe defaults require that access decisions deny unless explicitly granted, so a failed authorisation check must return deny rather than permit. Explicitly denying on failure satisfies this constraint, preventing accidental access when the check cannot confirm permission.

Psychological acceptability requires security mechanisms to be usable enough that users do not circumvent them. A mobile app push notification approves authentication with a single tap, imposing minimal cognitive burden while preserving the second factor, unlike cumbersome token entry or complex password rules.

Encoding output neutralises injected markup before it reaches the browser, blocking cross-site scripting even when input validation fails. This satisfies the stem's layered-control requirement: an independent, downstream safeguard that still contains an attacker after an earlier defensive layer is bypassed, rather than relying on any single control.

Running services with minimal OS privileges ensures that if a service is compromised, the attacker gains limited access. This is a core aspect of least privilege, applied to service accounts. It reduces the blast radius and prevents privilege escalation. Therefore, it is a correct practice for achieving least privilege in system design.

Availability ensures authorised users can access services and data when required, including under heavy load or active denial-of-service conditions. The other pillars address secrecy and integrity, not sustained service access, so availability directly matches the scenario described.

Synchronous replication maintains a live duplicate of data, so service continues when the primary database fails. This directly satisfies the stem's requirement that data remain accessible despite server failure, which is the availability leg of the CIA triad rather than integrity or confidentiality.

Economy of Mechanism keeps the design as simple as possible, so fewer code paths, interfaces and features exist for attackers to exploit. Reduced complexity directly shrinks the attack surface and lowers the chance of implementation flaws.

Layered controls at distinct tiers: input validation and parameterised queries harden application code against injection, while a WAF filters malicious HTTP traffic at the perimeter. Compromise of one layer does not defeat the others, satisfying the defence-in-depth requirement.

Open Design holds that security must not depend on secrecy of the design itself. Publishing the architecture invites independent scrutiny, allowing flaws to be identified and corrected rather than hidden, which strengthens assurance without relying on obscurity.

Non-repudiation requires proof binding an action to a specific identity such that the actor cannot later deny it. Digital signatures provide this through cryptographic keys unique to the signer, verifying origin and integrity, and satisfying the requirement for undeniable attribution of the transaction.

Open design states that the security of a system should not depend on the secrecy of its design or implementation, but rather on the secrecy of keys or passwords. This aligns with Kerckhoffs's principle. By making the algorithm public and subject to scrutiny, vulnerabilities are more likely to be found and fixed. The scenario directly describes this principle, where security rests on key secrecy, not algorithm secrecy.

In STRIDE, 'S' denotes Spoofing, which covers threats where an attacker impersonates a legitimate user, service, or system to gain unauthorised access. It is countered through authentication mechanisms that verify claimed identities before trust is granted.

Requiring the client_secret proves the token request originates from the legitimate registered client, not an interceptor holding a stolen code. This client authentication mechanism satisfies the stem by binding the code exchange to a verified identity.

Tampering is one of the six STRIDE categories, covering unauthorised modification of data or code in transit or at rest. It is explicitly defined by the methodology, so it correctly satisfies the stem's requirement to identify categories STRIDE names.

Hardcoded keys sit in source control, readable by anyone with repository access, so the secret is no longer restricted to authorised parties. That exposure breaches confidentiality, the property ensuring information is disclosed only to those permitted to see it.

Digital signatures bind the sender's private key to the message, so the signer cannot later deny authorship; this provides non-repudiation, proving origin and integrity to a third party. Confidentiality and authentication alone do not prevent the sender disputing the message.

Cryptographic hash functions produce a fixed-length digest that changes if any byte of the file alters, so recomputing and comparing the digest detects unauthorised modification. This directly satisfies integrity, which requires data to remain accurate and unaltered, unlike confidentiality (encryption) or availability (redundancy).

Assume breach removes implicit trust in the internal network, so every request is treated as potentially hostile. Designers therefore segment, log and limit blast radius rather than relying on perimeter defence, which is the foundational mindset the Zero Trust model requires before verification and least privilege can operate.