SE Security Architecture and Design 2

Question 1

What is a Secure Software Development Lifecycle (SSDLC), and why is it important?

Accepted Answer

An approach integrating security activities into every phase of software development to find and fix flaws early

Answer

SSDLC integrates security requirements, design reviews, code analysis, and testing throughout development, making security a built-in property rather than an afterthought.

Question 2

Which STRIDE category describes an attacker gaining capabilities or permissions beyond what was intended?

Accepted Answer

Elevation of privilege

Answer

The 'E' in STRIDE — Elevation of Privilege — covers scenarios where an attacker gains unauthorized access rights beyond their intended permission level.

Question 3

What is the primary goal of a security architecture review?

Accepted Answer

Ensure the system design meets security requirements and identify architectural weaknesses before implementation

Answer

A security architecture review evaluates the design against security principles and requirements to catch structural weaknesses early in the development lifecycle.

Question 4

In cloud security architecture, what does the Shared Responsibility Model define?

Accepted Answer

Which security responsibilities belong to the cloud provider vs. the customer

Answer

The Shared Responsibility Model clarifies that cloud providers secure the underlying infrastructure while customers are responsible for their data, applications, and access controls.

Question 5

Which design approach reduces the impact of a single component compromise by running components with only the permissions they need for their specific function?

Accepted Answer

Least privilege / minimal footprint per component

Answer

Applying least privilege at the component level ensures that even if one microservice or process is compromised, its blast radius is limited.

SE - Security Engineer Practice Test

SE - Security Engineer Practice Test

SE Security Architecture and Design 2