Mixed Deck — All CASE Topics Flashcards

When should threat modeling ideally be performed in the secure SDLC?

Answer: During the design phase and revisited as the design changes

Threat modeling is most cost-effective in design and should be updated as architecture evolves.

Which tool or methodology is most appropriate for analyzing app security engineer threat modeling outcomes?

Answer: Maintaining professional boundaries while building collaborative relationships

Maintaining professional boundaries while building collaborative relationships is the correct approach because effective app security engineer threat modeling in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

In the context of application security engineer, which principle most directly governs app security engineer threat modeling practices?

Answer: Applying evidence-based methodologies with peer-reviewed support

Applying evidence-based methodologies with peer-reviewed support is the correct approach because effective app security engineer threat modeling in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Review: boolean isAdmin = true; try { isAdmin = checkRole(user); } catch (Exception e) { log.error(e); } — what is the flaw?

Answer: It fails open: if checkRole throws, the user is treated as an admin

Initializing to true means an exception leaves privileged access granted; it should default to false.

Why is symmetric encryption preferred over asymmetric for bulk data encryption?

Answer: It is significantly faster and more efficient for large volumes

Symmetric encryption is computationally faster than asymmetric encryption, making it suitable for encrypting large datasets.

Which of the following SHOULD be recorded in a security log?

Answer: A failed login attempt with timestamp, username, and source IP

Security events should be logged with context, but never secrets like passwords, tokens, or full card numbers.

Which cryptographic property ensures a sender cannot deny having transmitted a message?

Answer: Non-repudiation

Non-repudiation prevents an originator from denying having sent a message, typically enforced through digital signatures.

What is the distinction between authentication and authorization?

Answer: Authentication verifies who you are; authorization determines what you are permitted to do

Authentication confirms a user's identity, while authorization determines which resources and actions that verified identity is permitted to access.

Which header setting prevents an application's pages from being framed by other sites to stop clickjacking?

Answer: X-Frame-Options: DENY

X-Frame-Options DENY (or CSP frame-ancestors 'none') blocks other origins from embedding the page in frames.

In ASP.NET web.config, which customErrors mode displays detailed error information, including stack traces, to remote users?

Answer: Off

mode="Off" shows detailed ASP.NET errors to all users, including remote ones, leaking internal information.

An attacker submits input containing CR/LF characters so that fake entries appear in the log file. What is this attack called?

Answer: Log injection (log forging)

Log injection uses newline characters to forge log entries, which can mislead investigators. The defense is to sanitize or encode user data before it is logged.

In the context of application security engineer, which principle most directly governs app security engineer secure development practices?

Answer: Applying evidence-based methodologies with peer-reviewed support

Applying evidence-based methodologies with peer-reviewed support is the correct approach because effective app security engineer secure development in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

A team uses a Web Application Firewall in front of a vulnerable legacy app while a code fix is developed. What is this approach called?

Answer: Virtual patching

Virtual patching uses WAF rules to block exploitation of a known flaw until the code is fixed.

What distinguishes an advanced application security engineer practitioner's approach to risk management & mitigation from that of a novice?

Answer: Establishing cross-functional teams with clearly defined roles

Establishing cross-functional teams with clearly defined roles is the correct approach because effective risk management & mitigation in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

How does Role-Based Access Control (RBAC) manage permissions?

Answer: By assigning permissions to defined roles rather than to individual users

RBAC assigns permissions to predefined roles, and users gain access by being assigned to roles appropriate for their job function.

What is the most common mistake professionals make when implementing app security engineer secure development strategies?

Answer: Developing contingency plans for high-probability risk scenarios

Developing contingency plans for high-probability risk scenarios is the correct approach because effective app security engineer secure development in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

What is the most common mistake professionals make when implementing app security engineer secure deployment strategies?

Answer: Developing contingency plans for high-probability risk scenarios

Developing contingency plans for high-probability risk scenarios is the correct approach because effective app security engineer secure deployment in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Which login failure message best prevents username enumeration?

Answer: "Invalid username or password."

A generic message does not reveal whether the username or the password was wrong.

Why is automated security testing important in application development?

Answer: It ensures consistent and efficient vulnerability detection

Automated security testing helps quickly identify vulnerabilities in large applications and ensures consistent testing across code changes.

What is the purpose of account provisioning?

Answer: Creating, configuring, and assigning user accounts and access rights when users join or change roles

Account provisioning is the process of creating and configuring user accounts with appropriate permissions aligned to the user's role.