Secure Software Architecture And Design

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Which design principle is exemplified by implementing a Web Application Firewall (WAF) to inspect incoming traffic before it hits the application logic?

During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

You are designing a web application and need to ensure the Principle of Least Privilege is applied to database access. Which approach best satisfies this requirement?

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

Which design activity helps identify security requirements during the earliest phases of the SDLC?

Which TWO of the following strategies best implement the principle of 'Separation of Duties' in an application design?

Which THREE of the following are key components of a 'Secure Design Review' process?

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Which TWO of the following design patterns improve the resilience of a secure system?

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

You are designing an application that integrates with a legacy system. Which design strategy minimizes the risk of the legacy system's vulnerabilities affecting your application?

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

When designing an API, which approach best supports the 'Complete Mediation' principle?

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?