Domain 4

Question 1

common security flaw in API

Answer 1

Broken or lack of authentication

Question 2

common format for his team’s software versioning (Common industry standard)

Answer 2

major.minor.patch

Question 2

OWASP’S Application Security Verification Standard (ASVS) has three primary usage models

Answer 2

To be used as:
Metric
Guidance
to be used during procurement

Question 3

dynamic secrets

Answer 3

Using dynamic secrets—secrets that are generated and used as they are needed—allows for granular auditing of uses because each secret is created as needed and thus their specific usage can be reviewed as needed

Question 4

ATASM

Answer 4

ATASM considers architecture, threats, attack surfaces (not attacks) and mitigations.

Question 5

Database Activity Monitor (DAM)

Answer 5

A Database Activity Monitor (DAM) solution provides database activity monitoring that includes privileged account usage logging and monitoring in addition to other security and monitoring features

Question 6

SMS Factors - least secure

Answer 6

SMS factors are considered the least secure of these options because of SIM swapping and VoIP-based attacks on SMS messages.

Question 7

XML Firewalls

Answer 7

XML firewalls can help improve the security of SAML-based applications by preventing XML-specific attacks

xml injection,
Security-focused code

Question 8

Interactive application security testing (IAST)

Answer 8

Interactive application security testing (IAST) uses software instrumentation to validate performance and function and is typically conducted during the QA/Test phase of the SDLC.

Question 9

SAFECode
Software Assurance Forum for Excellence in Code (SAFECode).

Answer 9

Changing encryption algorithms if a problem is found with one that is currently in use is actually a best practice that SAFECode recommends. They call it “cryptographic agility” and note that you need to be able to transition to new mechanisms, libraries, and keys when needed. Defining what to protect, what mechanisms will be used, and how keys and certificates will be managed are all common best practices and are also recommended by SAFECode.

Question 10

Abuse Case Testing

Answer 10

Abuse case testing will test how users could abuse the software, including the type of issues James is concerned about. White box, or full knowledge, testing and black box, or zero knowledge, testing both describe the amount of information that testers have about the environment, and use case testing validates how software is supposed to be used, not how it could be abused.

Question 11

If containers currently run as root.
Remediation

Answer 11

Setting a nonprivileged user as the process owner will work in many cases.