CSLLP Secure Software Design 1 — Questions and Answers
Question 1: Which design principle advocates that components with different trust levels or functions should be isolated from one another?
- Economy of mechanism
- Separation of duties
- Compartmentalization (Correct answer)
- Fail securely
Correct answer: Compartmentalization
Compartmentalization isolates system components so that a compromise in one area does not automatically lead to a compromise in others.
Question 2: A multi-tier architecture that separates presentation, business logic, and data storage is considered a best practice because it:
- Eliminates the need for input validation
- Limits the blast radius of a breach and enforces separation of concerns (Correct answer)
- Reduces the need for authentication
- Speeds up development by reducing code complexity
Correct answer: Limits the blast radius of a breach and enforces separation of concerns
Separating tiers means an attacker who compromises the presentation layer does not automatically gain access to the database, limiting damage and enabling independent security controls.
Question 3: What is the primary security benefit of using parameterized queries in database interactions?
- They improve query performance
- They prevent SQL injection by separating SQL logic from user-supplied data (Correct answer)
- They encrypt database traffic
- They enforce database access controls
Correct answer: They prevent SQL injection by separating SQL logic from user-supplied data
Parameterized queries ensure user input is always treated as data rather than executable SQL code, effectively preventing SQL injection attacks.
Question 4: Which principle states that a system should default to a secure state when it fails or encounters an error?
- Least privilege
- Complete mediation
- Fail securely (Correct answer)
- Open design
Correct answer: Fail securely
Fail securely (or fail safe) ensures that when an error occurs, the system defaults to a secure state such as denying access rather than inadvertently allowing it.
Question 5: In cryptographic design, what is the purpose of a salt?
- To increase encryption speed
- To add random data to passwords before hashing, preventing precomputed hash attacks (Correct answer)
- To extend the length of an encryption key
- To compress data before encryption
Correct answer: To add random data to passwords before hashing, preventing precomputed hash attacks
A cryptographic salt is random data added to a password before hashing, ensuring that identical passwords produce different hash values and defeating rainbow table attacks.
Question 6: Which architectural pattern uses a single component to handle all requests and enforce consistent security checks before routing to handlers?
- Observer pattern
- Factory pattern
- Front controller pattern (Correct answer)
- Decorator pattern
Correct answer: Front controller pattern
The Front Controller pattern centralizes request handling so that authentication, authorization, and input validation are applied consistently before any business logic is reached.
CSLLP Secure Software Design 1
Which design principle advocates that components with different trust levels or functions should be isolated from one another?