D487 - Secure Software Design

Question 21: An organization has implemented multi-factor authentication (MFA) for all employees. However, there have been reports of employees being locked out of their accounts due to lost authentication devices. What is the best approach to mitigate this issue?

Disable MFA for employees who frequently lose devices

Provide backup authentication methods

Increase the number of allowed login attempts

Conduct training on proper device management

Question 22: A security analyst has discovered that sensitive data is being transmitted in plaintext over the network. What is the most effective immediate action to address this issue?

Increase network monitoring

Implement encryption protocols for data in transit

Restrict access to sensitive data

Notify users of the security risk

Question 23: During a security audit, it was found that access controls for a sensitive database were not properly enforced. What remediation action should the organization take first?

Increase the frequency of audits

Implement stricter access controls immediately

Train employees on data handling procedures

Review all user permissions

Question 24: A company has decided to implement a bring-your-own-device (BYOD) policy for employees. What is the most critical security measure to include in this policy?

Restrict the types of devices employees can use

Require employees to install antivirus software

Implement mobile device management (MDM) solutions

Limit the use of personal devices to company email only

Question 25: A developer has been tasked with implementing an authentication feature for a web application. Which of the following practices should the developer prioritize to ensure secure authentication?

Allow users to choose their own passwords

Store passwords in plaintext for easy access

Implement account lockout mechanisms after multiple failed attempts

Use a single-factor authentication method for convenience

Question 26: A company is implementing a new data backup strategy. What is the best practice to ensure data integrity during backups?

Back up data once a week

Perform regular integrity checks on backups

Store all backups in a single location

Use compression to save space on backup media

Question 27: A security team has discovered that an application has not been properly patched, leading to vulnerabilities being exposed. What is the best strategy to prevent this in the future?

Increase the number of security assessments performed

Implement a patch management process

Rely on third-party security tools for detection

Train developers on security best practices

Question 28: An organization is experiencing data breaches due to insider threats. Which of the following practices should be prioritized to mitigate this risk?

Conduct background checks on employees

Implement strict data access controls and monitoring

Increase the number of employees

Use complex passwords

Question 29: During a security review, it was identified that an application lacks proper logging and monitoring mechanisms. What should the organization do to address this?

Increase employee awareness of security policies

Implement centralized logging and monitoring solutions

Conduct regular security audits

Improve user access controls

Question 30: A company wants to ensure that sensitive information shared with third-party vendors is protected. What is the best practice for managing this risk?

Require vendors to sign non-disclosure agreements (NDAs)

Encrypt sensitive information before sharing

Limit the amount of sensitive information shared

Conduct background checks on vendor employees

Question 31: A new employee reports that they are unable to access certain resources needed for their job. Upon investigation, it is discovered that the employee's access permissions have not been set up correctly. What is the best course of action to prevent this issue in the future?

Conduct regular access audits

Implement an automated access management system

Provide additional training to new employees

Increase the number of IT staff

Question 32: A company is evaluating different security frameworks to adopt. Which framework is known for its focus on risk management and continuous improvement?

NIST Cybersecurity Framework

ISO/IEC 27001

COBIT

CIS Controls

Question 33: A security analyst is reviewing a recently deployed application and discovers that it is vulnerable to cross-site scripting (XSS) attacks. What is the most effective way to prevent XSS vulnerabilities?

Validate user input on the client side

Use Content Security Policy (CSP) headers

Increase input length limits

Restrict access to sensitive pages

Question 34: A security team is evaluating the effectiveness of its incident response plan. What is the most important aspect to assess?

Frequency of plan updates

Training sessions for staff

Time taken to respond to incidents

Documentation of previous incidents

Question 35: An organization is implementing a new software application. What is the most critical phase of the software development life cycle (SDLC) to focus on security?

Design

Testing

Implementation

Maintenance

Question 36: A company is concerned about data breaches due to lost or stolen laptops. What measure should be prioritized to protect sensitive information on these devices?

Use full disk encryption

Implement stricter access controls

Increase physical security measures

Provide user training on data handling

Question 37: A company has implemented a new web application but is concerned about potential security vulnerabilities. What is the most effective way to identify these vulnerabilities before deployment?

Conduct a security training session for developers

Perform a penetration test

Increase code reviews

Implement logging and monitoring

Question 38: During a security audit, it was discovered that an application allows users to upload files without proper validation. What type of vulnerability could this lead to?

Cross-site scripting (XSS)

Remote code execution

SQL injection

Man-in-the-middle attacks

Question 39: An organization is evaluating its security posture and decides to conduct a tabletop exercise. What is the primary purpose of this exercise?

Train employees on security protocols

Assess the effectiveness of the incident response plan

Review security policies and procedures

Test security controls

Question 40: A company is experiencing frequent phishing attacks. What is the most effective method to reduce the success rate of these attacks?

Implement stronger email filters

Provide phishing awareness training for employees

Monitor employee email usage

Increase the frequency of security audits

D487 Secure Software Design - Set 1 - Part 2