Secure Software Concepts

An application utilizes the Clark-Wilson integrity model. Which mechanism does it use to ensure that subjects only perform authorized operations on objects?

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

When designing secure software, why is 'Economy of Mechanism' important?

Which of the following is an example of defense-in-depth in a web application architecture?

Which TWO of the following actions support the 'Open Design' security principle?

Which TWO of the following are essential components for achieving 'Non-repudiation'?

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

Which TWO of the following are examples of how software can maintain 'Integrity'?

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

You are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is the outcome?