I85PREP
⌘ K
EC-Council CASE study materials
EC-Council CASE study resources

EC-Council CASE practice questions

One question at a time. Build your EC-Council CASE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Understanding Application Security, Threats, and Attacks

In the OWASP Top 10, which category describes an application that stores user-supplied HTML and later renders it to other users without encoding, allowing script execution in their browsers?

  1. Insecure Deserialization
  2. Broken Access Control
  3. SQL Injection
  4. Cross-Site Scripting Correct answer.

Explanation

Cross-Site Scripting occurs when untrusted data reaches a browser as executable markup or script, so the attacker's code runs in the victim's session context. Stored XSS is the persistent variant where the payload is saved server-side and served to later visitors. Encoding output and validating input are the standard mitigations.

Question 2Understanding Application Security, Threats, and Attacks

A developer wants to eliminate SQL injection in a login query that concatenates the username directly into the statement. Which change addresses the root cause?

  1. Using parameterized queries with bound placeholders Correct answer.
  2. Restricting the login form to POST requests
  3. Escaping single quotes in the username field
  4. Hiding database error messages from the user

Explanation

Parameterized queries separate SQL code from data, so user input can never alter statement structure. Escaping is fragile and error-prone across database dialects and encodings. Error suppression and HTTP method choice reduce information leakage or change transport but leave the injection intact.

Question 3Understanding Application Security, Threats, and Attacks

Which HTTP response header instructs modern browsers to refuse to render a page inside a frame, mitigating clickjacking?

  1. X-Content-Type-Options: nosniff
  2. Strict-Transport-Security
  3. X-Frame-Options: DENY Correct answer.
  4. Referrer-Policy: no-referrer

Explanation

X-Frame-Options with DENY or SAMEORIGIN prevents the page from being embedded in a frame on another origin, which blocks classic clickjacking overlays. The Content-Security-Policy frame-ancestors directive provides the modern equivalent. The other headers address MIME sniffing, transport security, and referrer leakage respectively.

Question 4Understanding Application Security, Threats, and Attacks

An attacker sends a victim a link to a banking site where a crafted request transfers funds, and the victim's browser automatically attaches the site's session cookie. Which vulnerability class does this illustrate?

  1. Session fixation
  2. Server-Side Request Forgery
  3. Cross-Site Scripting
  4. Cross-Site Request Forgery Correct answer.

Explanation

CSRF exploits the browser's automatic inclusion of ambient credentials such as cookies, causing the victim's authenticated session to perform an unintended action. Anti-CSRF tokens and SameSite cookie attributes are the primary defenses. SSRF instead abuses server-side requests, and session fixation concerns pre-set session identifiers.

Question 5Understanding Application Security, Threats, and Attacks

What is the primary purpose of input validation in an application security program?

  1. Balancing load across application servers
  2. Encrypting sensitive fields at rest
  3. Recording user actions for forensic review
  4. Ensuring data conforms to expected format, type, and range before processing Correct answer.

Explanation

Input validation enforces syntactic and semantic constraints so that only well-formed data reaches business logic, parsers, and interpreters. It is a defense-in-depth control and never a substitute for context-aware output encoding or parameterization. Encryption, logging, and load balancing serve different objectives.

Question 6Understanding Application Security, Threats, and Attacks

Which term describes an attack in which the adversary inserts themselves between a client and server to read or alter traffic?

  1. Directory traversal
  2. Privilege escalation
  3. Race condition
  4. Man-in-the-Middle Correct answer.

Explanation

A Man-in-the-Middle attack positions the adversary as a relay between two parties, enabling interception and modification of communications. TLS with proper certificate validation is the standard countermeasure. The other terms describe elevation of rights, path manipulation, and timing flaws.

Question 7Understanding Application Security, Threats, and Attacks

A web application passes a user-controlled filename to a file read function, and an attacker submits ../../etc/passwd. Which class of vulnerability is being exploited?

  1. Path traversal Correct answer.
  2. Insecure deserialization
  3. XML External Entity injection
  4. Open redirect

Explanation

Path traversal, also called directory traversal, uses dot-dot-slash sequences to escape the intended base directory and access arbitrary files. Canonicalizing the resolved path and verifying it stays within an allowlisted directory mitigates it. The other options involve object reconstruction, XML parser entity expansion, and uncontrolled redirect targets.

Question 8Understanding Application Security, Threats, and Attacks

An application parses XML input with a parser that resolves external entities. An attacker supplies a document that references a local file and an internal URL. Which two risks are most directly introduced?

  1. Local file disclosure and server-side request forgery Correct answer.
  2. SQL injection and log injection
  3. Session fixation and cookie theft
  4. Cross-site scripting and clickjacking

Explanation

XML External Entity injection lets an attacker define entities that read local files or trigger outbound requests from the server, producing file disclosure and SSRF. Disabling external entity resolution and DTD processing is the core remediation. The other pairs are unrelated to XML parser entity handling.

Question 9Understanding Application Security, Threats, and Attacks

Which practice most directly defends against insecure deserialization of untrusted data in a Java application?

  1. Increasing the JVM heap size
  2. Avoiding native deserialization of untrusted input and enforcing class allowlists Correct answer.
  3. Base64-encoding the serialized byte stream
  4. Compressing serialized payloads before transmission

Explanation

Native deserialization can instantiate attacker-chosen classes and trigger gadget chains, so the safest approach is not to deserialize untrusted data at all. Where it is unavoidable, strict allowlisting of permitted classes limits what can be constructed. Encoding, compression, and memory tuning do not constrain object graphs.

Question 10Understanding Application Security, Threats, and Attacks

An API returns full user records, including password hashes and internal role flags, to any authenticated caller. Which OWASP category best describes this weakness?

  1. Security Misconfiguration
  2. Insufficient Logging and Monitoring
  3. Vulnerable and Outdated Components
  4. Broken Access Control Correct answer.

Explanation

Returning data beyond what the caller is authorized to see is an access control failure, sometimes called excessive data exposure or broken object property level authorization. The fix is server-side enforcement of which fields each role may receive. Misconfiguration, outdated components, and logging gaps do not describe unauthorized data disclosure to a legitimate but under-privileged user.

Question 11Understanding Application Security, Threats, and Attacks

An attacker changes an identifier in a URL from /invoice/1001 to /invoice/1002 and views another customer's invoice. Which term names this flaw?

  1. HTTP request smuggling
  2. Insecure Direct Object Reference Correct answer.
  3. Cross-Site Scripting
  4. Server-Side Template Injection

Explanation

Insecure Direct Object Reference occurs when an application exposes an internal identifier and fails to verify that the requester owns or may access that object. Authorization checks tied to the authenticated principal, not merely authentication, are required. The other options describe script injection, template evaluation, and request parsing desynchronization.

Question 12Understanding Application Security, Threats, and Attacks

Which condition is required for a Cross-Site Scripting attack to succeed against a victim?

  1. The victim must have administrative privileges
  2. The attacker must be on the same local network as the victim
  3. The server must run an outdated TLS version
  4. Attacker-controlled data must reach the victim's browser as executable content Correct answer.

Explanation

XSS requires that untrusted input be interpreted by the browser as markup or script within a security context the attacker wants to act in. This can happen through reflected, stored, or DOM-based sinks. Administrative rights, TLS version, and network proximity are not prerequisites.

Question 13Understanding Application Security, Threats, and Attacks

A login endpoint responds noticeably faster for valid usernames than for invalid ones. Which weakness does this behavior reveal?

  1. Username enumeration through timing differences Correct answer.
  2. Insecure direct object reference
  3. Cross-site request forgery
  4. Buffer overflow in the authentication handler

Explanation

Observable differences in response time or message content let an attacker determine which accounts exist, aiding credential attacks. Responses should be uniform in timing and content regardless of whether the account exists. Buffer overflows, IDOR, and CSRF describe different failure modes.

Question 14Understanding Application Security, Threats, and Attacks

Which control best mitigates Server-Side Request Forgery in a feature that fetches a user-supplied URL?

  1. Disabling TLS verification for outbound requests
  2. Logging the requested URL after the fetch completes
  3. Encoding the URL with HTML entities
  4. Validating the destination against an allowlist and blocking internal address ranges Correct answer.

Explanation

SSRF defense centers on restricting where the server may connect, typically with an allowlist of approved hosts and denial of private, loopback, and link-local ranges including cloud metadata addresses. Disabling TLS verification weakens security, and post-hoc logging does not prevent the request. HTML encoding is irrelevant to server-side network calls.

Question 15Understanding Application Security, Threats, and Attacks

An application builds OS commands by concatenating a user-supplied hostname into a ping invocation. Which remediation is most robust?

  1. Avoiding the shell and passing arguments as an array to an execution API Correct answer.
  2. Running the application as a non-root user
  3. Removing semicolons from the hostname string
  4. Rate limiting requests to the endpoint

Explanation

OS command injection is eliminated by not invoking a shell and by passing each argument separately to an execution API, so metacharacters cannot alter command structure. Blacklisting characters is bypassable, and privilege reduction or rate limiting only limits impact.

Question 16Understanding Application Security, Threats, and Attacks

A penetration tester finds that a JWT is accepted even after the signature segment is altered, because the server never verifies it. Which security failure does this represent?

  1. Insecure deserialization of the token payload
  2. Directory traversal in token retrieval
  3. Cross-site scripting in the token storage
  4. Broken authentication due to missing token integrity verification Correct answer.

Explanation

A JSON Web Token is only trustworthy when its signature is validated against a trusted key and the algorithm is pinned, so skipping verification lets an attacker forge claims such as a privileged role. This is an authentication and session integrity failure. XSS, deserialization, and traversal describe unrelated mechanisms.

Question 17Understanding Application Security, Threats, and Attacks

An attacker submits a crafted serialized object to a Python service that calls pickle.loads on request data, achieving remote code execution. Which property of the pickle format makes this possible?

  1. Deserialization can invoke arbitrary callables during object reconstruction Correct answer.
  2. Pickle payloads are always compressed with zlib
  3. Pickle enforces a strict schema that rejects unknown classes
  4. Pickle output is encrypted with a shared key

Explanation

The pickle protocol supports opcodes that reference and call Python callables, so loading hostile data can execute code before any validation occurs. Untrusted pickle data should never be deserialized; safer formats such as JSON with schema checks are preferred. The other statements misdescribe the format.

Question 18Understanding Application Security, Threats, and Attacks

A front-end proxy forwards requests based on Content-Length while the back-end server honors Transfer-Encoding: chunked. An attacker crafts a request that both parse differently. Which attack results?

  1. Cross-site tracing
  2. Session fixation
  3. HTTP request smuggling Correct answer.
  4. XML entity expansion

Explanation

HTTP request smuggling exploits disagreements between intermediaries about message boundaries, letting an attacker prepend a request that is attributed to another user's connection. Consistent parsing and rejecting ambiguous headers at the edge are the defenses. The other options involve HTTP method abuse, session identifiers, and XML entities.

Question 19Understanding Application Security, Threats, and Attacks

An application reflects user input inside a JavaScript string literal in an inline script block. Which output handling approach is most appropriate?

  1. JavaScript-context encoding of the value and avoiding inline script where feasible Correct answer.
  2. URL encoding of the value
  3. HTML entity encoding of the value only
  4. Base64 encoding of the value

Explanation

Encoding must match the sink context; inside a script block, HTML entity encoding does not prevent breaking out of the string literal, so JavaScript-specific encoding is required. Placing data in a non-executable element and reading it via the DOM, together with a strict Content-Security-Policy, further reduces risk. URL and Base64 encodings are not context-correct for script literals.

Question 20Understanding Application Security, Threats, and Attacks

A security review finds that an application trusts the X-Forwarded-For header to decide whether a request originates from an internal network, granting elevated features. Which conclusion is most accurate?

  1. The header is cryptographically signed and therefore reliable
  2. The trust decision is forgeable because the client controls the header value Correct answer.
  3. The header enforces mutual TLS automatically
  4. The header is only set by browsers and cannot be spoofed

Explanation

X-Forwarded-For is a plain request header that any client can set unless an edge proxy strips and rewrites it. Using it for authorization lets an attacker claim an internal origin and gain elevated features. Trust decisions should rely on verified network position or authenticated identity, not client-supplied headers.

Question 21Security Requirements Gathering

During requirements gathering for a new payment service, the team must capture how the system should behave when a customer's card is declined. Which requirements category primarily addresses this expected system behavior under defined conditions?

  1. Security requirements
  2. Non-functional requirements
  3. Functional requirements Correct answer.
  4. Regulatory requirements

Explanation

Functional requirements describe what the system must do, including specific behaviors and responses under defined conditions such as a declined transaction. Security and regulatory requirements constrain or govern behavior rather than define the functional response itself.

Question 22Security Requirements Gathering

A security analyst is documenting requirements for a customer-facing portal. The team agrees that all account data must remain readable only to the account owner and support staff with a documented need. Which security objective is being specified?

  1. Availability
  2. Confidentiality Correct answer.
  3. Non-repudiation
  4. Integrity

Explanation

Confidentiality ensures data is disclosed only to authorized parties, which matches restricting account data to the owner and approved staff. The other objectives address uptime, proof of action, and data accuracy respectively.

Question 23Security Requirements Gathering

Which artifact best captures the agreed security requirements baseline that developers and auditors will both reference during a project?

  1. An incident response runbook
  2. A security requirements specification document Correct answer.
  3. A penetration test report from a prior project
  4. A verbal agreement recorded in meeting minutes

Explanation

A security requirements specification is the formal, reviewable baseline that stakeholders approve and that development and audit teams reference. Meeting minutes, prior test reports, and runbooks serve other purposes and are not requirement baselines.

Question 24Security Requirements Gathering

A requirement states: 'The application shall encrypt data at rest using AES-256.' Which characteristic of a well-formed security requirement does this statement best demonstrate?

  1. Prioritization
  2. Traceability
  3. Testability Correct answer.
  4. Ambiguity

Explanation

Specifying AES-256 makes the requirement verifiable through inspection or testing, which is the testability characteristic. Traceability and prioritization are separate attributes, and ambiguity is a defect rather than a desirable trait.

Question 25Security Requirements Gathering

Which stakeholder group is most important to involve when eliciting requirements about acceptable logging of personally identifiable information?

  1. Only the front-end development team
  2. Only the external penetration testing vendor
  3. Legal and privacy counsel together with business owners Correct answer.
  4. Only the infrastructure operations team

Explanation

Logging of personal data raises legal and privacy obligations, so counsel and business owners must define acceptable handling. Technical teams alone cannot determine lawful and acceptable data use.

Question 26Security Requirements Gathering

When gathering security requirements, which approach best ensures that requirements are derived from actual business risk rather than generic checklists?

  1. Copying requirements verbatim from a public template
  2. Performing a risk assessment and mapping threats to business assets Correct answer.
  3. Adopting every control in a framework without analysis
  4. Waiting until the testing phase to identify risks

Explanation

Risk assessment identifies which assets matter and which threats are relevant, allowing requirements to be prioritized by business impact. Templates and blanket framework adoption ignore context, and deferring risk work to testing is too late.

Question 27Security Requirements Gathering

A team is defining requirements for an API that handles financial transfers. They want to specify that each request must be authenticated and authorized before processing. Which requirement type are they writing?

  1. A performance requirement
  2. A backup requirement
  3. An access control requirement Correct answer.
  4. A usability requirement

Explanation

Authentication and authorization before processing are access control requirements. Performance, usability, and backup requirements address speed, user experience, and data recovery respectively.

Question 28Security Requirements Gathering

During elicitation, a business owner says the system 'must be secure.' Which follow-up best converts this into an actionable security requirement?

  1. Replace it with a generic list of all known controls
  2. Record the statement as-is and move on
  3. Defer the requirement to the operations team after launch
  4. Ask which assets, threats, and acceptance criteria define 'secure' for this system Correct answer.

Explanation

Vague goals must be decomposed by identifying the assets to protect, the threats of concern, and measurable acceptance criteria. Recording it verbatim, applying generic controls, or deferring it leaves the requirement untestable.

Question 29Security Requirements Gathering

A requirements team documents that a new HR system must retain audit records of every access to salary data for seven years. Which two concerns does this requirement combine?

  1. Auditability and data retention Correct answer.
  2. Interoperability and portability
  3. Usability and localization
  4. Availability and scalability

Explanation

Recording every access supports auditability, and keeping records for seven years is a data retention obligation. The other pairs describe unrelated quality attributes.

Question 30Security Requirements Gathering

Which practice best supports traceability of security requirements through the software development lifecycle?

  1. Rewriting requirements at each phase without identifiers
  2. Relying on developers to remember requirements verbally
  3. Assigning a unique identifier to each requirement and linking it to design, code, and test cases Correct answer.
  4. Storing requirements only in email threads

Explanation

Unique identifiers and explicit links to design, implementation, and tests allow verification that each requirement is addressed and tested. Informal storage, rewriting, and verbal reliance break traceability.

Question 31Security Requirements Gathering

A requirement states: 'The system should probably log failed login attempts if feasible.' Which quality defect is most evident?

  1. It duplicates another requirement
  2. It uses ambiguous and non-committal language Correct answer.
  3. It is not traceable to a source
  4. It is over-specified with excessive detail

Explanation

Words like 'probably' and 'if feasible' make the requirement ambiguous and unverifiable. Traceability, over-specification, and duplication are different defects not shown here.

Question 32Security Requirements Gathering

When eliciting security requirements for a third-party integration, which input is most valuable for identifying the obligations the vendor must meet?

  1. The previous year's internal training slides
  2. The internal team's preferred coding style guide
  3. The vendor's marketing brochure
  4. The contractual security terms and data processing agreement Correct answer.

Explanation

Contractual security terms and data processing agreements define the vendor's obligations and are the authoritative source for integration security requirements. Marketing materials, style guides, and old training slides do not establish obligations.

Question 33Security Requirements Gathering

A team is deciding how to express a requirement that sensitive data must be masked in non-production environments. Which formulation is the strongest security requirement?

  1. Try to avoid using real data in testing
  2. Mask sensitive data where appropriate
  3. Non-production data handling should follow good practice
  4. Sensitive data shall be masked using an approved method before being copied to any non-production environment Correct answer.

Explanation

The strongest formulation specifies the mandatory action, the approved method, and the exact condition, making it verifiable. The other options rely on vague qualifiers that cannot be tested.

Question 34Security Requirements Gathering

Which technique is most effective for uncovering security requirements that stakeholders have not explicitly stated during interviews?

  1. Reviewing only the project budget
  2. Reading the company's social media posts
  3. Sending a single survey with yes/no questions
  4. Threat modeling workshops with architects and business owners Correct answer.

Explanation

Threat modeling workshops systematically identify threats and derive requirements that stakeholders may not articulate on their own. Surveys, budgets, and social media do not provide structured threat analysis.

Question 35Security Requirements Gathering

A requirements analyst must reconcile a business desire for fast checkout with a security requirement for strong customer authentication. What is the most appropriate way to document the outcome?

  1. Drop the authentication requirement to preserve speed
  2. Escalate without documenting either requirement
  3. Record both requirements with their rationale and an agreed trade-off decision Correct answer.
  4. Document only the speed requirement

Explanation

Conflicting requirements should both be recorded with rationale and a documented trade-off decision so the resolution is transparent and traceable. Dropping a requirement or omitting documentation hides the decision.

Question 36Security Requirements Gathering

Which statement best describes the role of acceptance criteria in security requirements gathering?

  1. They replace the need for security requirements
  2. They describe the project schedule
  3. They define how fulfillment of a requirement will be verified Correct answer.
  4. They list the team members responsible for coding

Explanation

Acceptance criteria establish the conditions under which a requirement is considered satisfied and verified. They complement rather than replace requirements and do not address scheduling or staffing.

Question 37Security Requirements Gathering

An organization must comply with a regulation requiring breach notification within 72 hours. How should this obligation influence security requirements gathering?

  1. It should be translated into detection, logging, and notification requirements with defined timelines Correct answer.
  2. It should be documented only after an incident occurs
  3. It should be assigned solely to the marketing team
  4. It should be ignored because it is a legal matter

Explanation

Regulatory obligations must be translated into concrete system capabilities such as timely detection, logging, and notification workflows. Treating them as purely legal or post-incident concerns leaves the system unable to comply.

Question 38Security Requirements Gathering

A team proposes a requirement: 'The system shall prevent all fraud.' Why is this requirement problematic from a requirements engineering perspective?

  1. It is not ambitious enough
  2. It duplicates the availability requirement
  3. It is too detailed about implementation
  4. It is unachievable and cannot be verified, so it provides no testable acceptance criteria Correct answer.

Explanation

Absolute prevention of all fraud is not realistically achievable and offers no measurable criteria for verification. Good requirements must be feasible and testable, so this statement cannot guide design or acceptance.

Question 39Security Requirements Gathering

During requirements gathering, two business units demand conflicting data residency rules for the same cloud service. Which approach best resolves this while preserving defensible security requirements?

  1. Map each unit's legal and risk drivers, then document a resolution with rationale and approvals Correct answer.
  2. Ignore both and use default cloud settings
  3. Average the two rules into a single vague statement
  4. Choose the cheaper option without analysis

Explanation

Understanding each unit's legal and risk drivers allows a reasoned resolution that is documented, approved, and traceable. Arbitrary selection, vague averaging, or defaults leave the conflict unresolved and indefensible.

Question 40Security Requirements Gathering

A security architect argues that a requirement for end-to-end encryption conflicts with a requirement for deep packet inspection by the network team. What is the most rigorous way to handle this in the requirements baseline?

  1. Silently remove encryption to satisfy inspection
  2. Delete both requirements to avoid disagreement
  3. Keep both requirements unchanged and let developers decide at coding time
  4. Document the conflict, analyze the risk of each option, and record an approved resolution with compensating controls Correct answer.

Explanation

Rigorous handling requires documenting the conflict, analyzing risks, and recording an approved resolution, possibly with compensating controls. Silent removal, unresolved handoff, or deletion undermines the baseline and leaves risk unmanaged.

Question 41Secure Application Design and Architecture

In a threat modeling exercise for a new payment API, the team wants to systematically enumerate how an attacker could tamper with data flowing between the mobile client and the backend. Which threat modeling approach is specifically organized around identifying these categories of threats against each element of the data flow?

  1. DREAD, which ranks discovered threats by damage, reproducibility, and exploitability
  2. STRIDE, which classifies threats into categories such as tampering, spoofing, and information disclosure Correct answer.
  3. Attack trees, which decompose a single attacker goal into sub-goals
  4. PASTA, which is organized primarily around business risk and attacker simulation phases

Explanation

STRIDE is a mnemonic threat-classification scheme (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) applied per element of a data-flow diagram, so it maps directly to enumerating tampering risks on each flow. The other techniques serve different purposes: risk-centric process, scoring, or goal decomposition.

Question 42Secure Application Design and Architecture

A security architect is choosing an access control model for a hospital system where access decisions depend on the clinician's role, the patient's assigned care team, and whether the request occurs during an active treatment relationship. Which model best expresses these dynamic, attribute-rich rules?

  1. Discretionary access control based on owner-set ACLs
  2. Attribute-based access control evaluating subject, resource, action, and environment attributes Correct answer.
  3. Role-based access control with static role-to-permission mapping
  4. Mandatory access control based on sensitivity labels

Explanation

ABAC evaluates policies over attributes of the subject, resource, action, and environment, which allows context such as an active treatment relationship to influence the decision. RBAC captures job function but not the dynamic contextual conditions described.

Question 43Secure Application Design and Architecture

Which principle states that a subject should be granted only the accesses necessary to complete its current task, and no more, for the shortest duration required?

  1. Least privilege Correct answer.
  2. Defense in depth
  3. Separation of duties
  4. Fail-safe defaults

Explanation

Least privilege limits rights to the minimum needed for the task and for the minimum time, reducing the blast radius of compromise or error. Separation of duties instead divides critical tasks among multiple parties.

Question 44Secure Application Design and Architecture

A design review flags that an application stores session identifiers in a cookie without the HttpOnly or Secure attributes and never rotates the identifier after authentication. Which vulnerability class does this design most directly enable?

  1. Insecure direct object reference on file downloads
  2. Session hijacking through script access and cleartext transmission Correct answer.
  3. SQL injection through unsanitized query parameters
  4. Server-side request forgery against internal metadata endpoints

Explanation

Missing HttpOnly lets client-side script read the cookie, and missing Secure allows it to travel over cleartext channels; failure to rotate on login permits session fixation. Together these enable theft and reuse of an authenticated session.

Question 45Secure Application Design and Architecture

An architect is designing a microservices platform and wants to ensure that a compromise of one service cannot be leveraged to call arbitrary other services with the user's broad token. Which design choice most directly enforces this?

  1. Relying on network segmentation alone to isolate service traffic
  2. Issuing short-lived, audience-restricted tokens per service-to-service call Correct answer.
  3. Centralizing all authorization decisions in the client application
  4. Sharing a single long-lived service account credential across all services

Explanation

Audience-restricted, short-lived tokens bound to the calling service limit what a stolen token can reach and for how long, supporting least privilege between services. Shared credentials and client-side decisions both widen the blast radius.

Question 46Secure Application Design and Architecture

Which cryptographic design flaw most directly undermines confidentiality when the same keystream is reused across two messages in a stream cipher?

  1. XORing the two ciphertexts cancels the keystream and reveals plaintext relationships Correct answer.
  2. The messages become forgeable through hash collision
  3. The key schedule degrades into a fixed substitution table
  4. The ciphertexts become vulnerable to length-extension attacks

Explanation

In a stream cipher, ciphertext is plaintext XOR keystream; reusing the keystream across messages lets an attacker XOR the ciphertexts to eliminate it, exposing the XOR of the plaintexts and enabling recovery. This is why nonces must never repeat under one key.

Question 47Secure Application Design and Architecture

A team wants to prevent a compromised front-end web server from reading secrets stored in its own environment variables. Which architectural control best addresses this?

  1. Rotating the environment variables on a weekly schedule
  2. Moving secrets to a dedicated secrets manager accessed with short-lived, per-workload credentials Correct answer.
  3. Encrypting the environment variables at rest on the host filesystem
  4. Restricting read access to the process environment via file permissions

Explanation

Centralizing secrets in a manager with short-lived, workload-scoped credentials means the front-end never holds long-lived secrets, so compromise of that host yields little. Local encryption or file permissions still leave the secret recoverable on the compromised host.

Question 48Secure Application Design and Architecture

In a defense-in-depth architecture, which control is best classified as a detective control rather than a preventive one?

  1. Mutual TLS requiring client certificates
  2. A web application firewall blocking known malicious payloads
  3. Input validation rejecting malformed fields
  4. An intrusion detection system alerting on anomalous east-west traffic Correct answer.

Explanation

Detective controls identify and report events after or during occurrence without necessarily stopping them; an IDS alerting on anomalous traffic fits that role. The other options actively block or reject activity, making them preventive.

Question 49Secure Application Design and Architecture

An application must verify the integrity and origin of a firmware update before applying it. Which design is most appropriate?

  1. Verifying a digital signature over the update using a public key embedded in the device Correct answer.
  2. Comparing the update against a checksum published on the same download page
  3. Relying on TLS alone during the download
  4. Encrypting the update with a symmetric key shared among all devices

Explanation

A signature verified with an embedded trusted public key binds the update to the vendor's private key and detects tampering even if the distribution channel is compromised. Checksums from the same channel and transport-only protection can be subverted by an attacker who controls that channel.

Question 50Secure Application Design and Architecture

Which design pattern most directly mitigates injection attacks by ensuring that data is never interpreted as code by the receiving component?

  1. Blacklist filtering of known malicious characters
  2. Storing user input in an encoded form in the database
  3. Escaping output only at the presentation layer
  4. Parameterized queries that bind values separately from the query structure Correct answer.

Explanation

Parameterization separates code from data so bound values cannot alter the query's structure, which is the structural fix for injection. Filtering and encoding may help in specific contexts but do not remove the underlying mixing of data and instructions.