Mock Intermediary

Question 1

What is one danger of relying solely on black-box testing? (v10)

Accepted Answer

It may miss internal logic or configuration vulnerabilities

Question 2

Why should third-party libraries be scanned regularly?

Accepted Answer

To detect known vulnerabilities and outdated components

Question 3

What is a main challenge of late-stage penetration testing? (v21)

Accepted Answer

Security issues are found too late to be fixed cost-effectively

Question 4

How do static and dynamic analysis differ? (v3)

Accepted Answer

Static inspects source code; dynamic evaluates running applications

Question 5

What does 'fail securely' mean? (v22)

Accepted Answer

The system defaults to a secure state in case of failure

Question 6

How does encryption support confidentiality? (v25)

Accepted Answer

It prevents unauthorized access to data in transit or at rest

Question 7

What is one pitfall of default configurations? (v6)

Accepted Answer

They may expose unnecessary services or open ports

Question 8

How do automated tools aid secure development? (v17)

Accepted Answer

They identify security flaws early and repeatedly

Question 9

How can logs support incident response? (v29)

Accepted Answer

They provide forensic evidence of user/system activity

Question 10

Why is role-based access control (RBAC) effective? (v18)

Accepted Answer

It limits user permissions based on assigned roles

Question 11

How can risk-based testing improve security validation?

Accepted Answer

By focusing test efforts on areas with the highest potential impact

Question 12

How do automated tools aid secure development? (v37)

Accepted Answer

They identify security flaws early and repeatedly

Question 13

How does DevSecOps differ from traditional DevOps?

Accepted Answer

It integrates security into every phase of the development cycle

Question 14

How does encryption support confidentiality? (v35)

Accepted Answer

It prevents unauthorized access to data in transit or at rest

Question 15

What does 'fail securely' mean? (v32)

Accepted Answer

The system defaults to a secure state in case of failure

Question 16

Which OWASP project focuses specifically on verifying application security controls?

Accepted Answer

OWASP ASVS

Question 17

What is one pitfall of default configurations? (v36)

Accepted Answer

They may expose unnecessary services or open ports

Question 18

What is a benefit of centralized logging? (v34)

Accepted Answer

It allows easier correlation of security events across systems

Question 19

What is one pitfall of default configurations? (v26)

Accepted Answer

They may expose unnecessary services or open ports

Question 20

What is one danger of relying solely on black-box testing? (v40)

Accepted Answer

It may miss internal logic or configuration vulnerabilities

Question 21

What does non-repudiation ensure in cybersecurity?

Accepted Answer

Actions or transactions cannot be denied after the fact

Question 22

Why is role-based access control (RBAC) effective? (v38)

Accepted Answer

It limits user permissions based on assigned roles

Question 23

How does encryption support confidentiality? (v15)

Accepted Answer

It prevents unauthorized access to data in transit or at rest

Question 24

What distinguishes STRIDE from other models?

Accepted Answer

It categorizes threats based on violated security properties

Question 25

What is a benefit of centralized logging? (v4)

Accepted Answer

It allows easier correlation of security events across systems

Question 26

How can logs support incident response? (v39)

Accepted Answer

They provide forensic evidence of user/system activity

Question 27

In threat modeling, what does a trust boundary indicate?

Accepted Answer

A point where the level of trust changes between components

Question 28

How can logs support incident response? (v19)

Accepted Answer

They provide forensic evidence of user/system activity

Question 29

What does 'fail securely' mean? (v12)

Accepted Answer

The system defaults to a secure state in case of failure

Question 30

Why is role-based access control (RBAC) effective? (v28)

Accepted Answer

It limits user permissions based on assigned roles

Question 31

How can logs support incident response? (v9)

Accepted Answer

They provide forensic evidence of user/system activity

Question 32

Why is role-based access control (RBAC) effective? (v8)

Accepted Answer

It limits user permissions based on assigned roles

Question 33

Why is security testing described as 'testing for negatives'?

Accepted Answer

It aims to identify unexpected and undesired system behavior

Question 34

What is a main challenge of late-stage penetration testing? (v1)

Accepted Answer

Security issues are found too late to be fixed cost-effectively

Question 35

What is a main challenge of late-stage penetration testing? (v31)

Accepted Answer

Security issues are found too late to be fixed cost-effectively

Question 36

How do static and dynamic analysis differ? (v13)

Accepted Answer

Static inspects source code; dynamic evaluates running applications

Question 37

How do static and dynamic analysis differ? (v33)

Accepted Answer

Static inspects source code; dynamic evaluates running applications

Question 38

How do automated tools aid secure development? (v27)

Accepted Answer

They identify security flaws early and repeatedly

Question 39

How do static and dynamic analysis differ? (v23)

Accepted Answer

Static inspects source code; dynamic evaluates running applications

Question 40

What is one danger of relying solely on black-box testing? (v20)

Accepted Answer

It may miss internal logic or configuration vulnerabilities

Question 41

What does a 'spoofing' attack typically target?

Accepted Answer

Authentication mechanisms

Question 42

What is one danger of relying solely on black-box testing? (v30)

Accepted Answer

It may miss internal logic or configuration vulnerabilities

Question 43

What is a benefit of centralized logging? (v24)

Accepted Answer

It allows easier correlation of security events across systems

Question 44

What is a benefit of centralized logging? (v14)

Accepted Answer

It allows easier correlation of security events across systems

Question 45

How does encryption support confidentiality? (v5)

Accepted Answer

It prevents unauthorized access to data in transit or at rest

Question 46

What type of threat does Cross-Site Scripting (XSS) represent?

Accepted Answer

Injection of malicious scripts into trusted websites

Question 47

What is one pitfall of default configurations? (v16)

Accepted Answer

They may expose unnecessary services or open ports

Question 48

What does 'fail securely' mean? (v2)

Accepted Answer

The system defaults to a secure state in case of failure

Question 49

How do automated tools aid secure development? (v7)

Accepted Answer

They identify security flaws early and repeatedly

Question 50

What is a main challenge of late-stage penetration testing? (v11)

Accepted Answer

Security issues are found too late to be fixed cost-effectively

Mock Intermediary

Questions 50

Mock Intermediary

Questions 50