SS_tut4

Requiring users to create passwords that are 20 characters long and include uppercase and lowercase letters, numbers, and symbols violates which security principle?

• Weakest Link

• Psychological Acceptability

• Leveraging Existing Components

• Attack Surface Minimization

Which of the following BEST describes the core concept of the 'Weakest Link' security principle?

• All components of a system must have equal levels of security.

• Focusing security efforts solely on publicly accessible systems.

• Identifying and prioritizing the most vulnerable components of a system.

• Using complex passwords to deter attackers.

Service-Oriented Architecture (SOA) is an example of which security principle?

• Weakest Link

• Attack Surface Reduction

• Leveraging Existing Components

• Defense in Depth

According to the lecture, a complex system with a single public API generally has:

• A minimal attack surface

• A maximal attack surface

• An attack surface that is difficult to calculate

• An attack surface independent of system complexity

The Relative Attack Surface Quotient (RASQ) is used to:

• Determine the absolute number of vulnerabilities in a system.

• Compare the relative 'attackability' of different versions of a system.

• Calculate the time it takes an attacker to compromise a system.

• Identify the weakest link in a software application.

Which of the following is a CORRECT pairing of a control type and its function?

• Preventative control - Restores a system after a security breach.

• Detective control - Prevents unauthorized access to a system.

• Corrective control - Reverses the impact of a security incident, such as restoring from a backup.

• Deterrent control - Identifies security policy violations.

It is generally considered best practice to disable protocols at which layer of the OSI model?

• Application Layer

• Transport Layer

• Session Layer

• Network Layer

Answer explanation

Disabling protocols is best done at the Application Layer because it directly manages user-level applications and services, allowing for better control over security and resource usage.

According to the lecture, which OSI layer handles encryption and compression of data?

• Application Layer

• Presentation Layer

• Session Layer

• Transport Layer

A software development team is building a new web application for online banking. Adhering to security principles, which of the following combinations would be the MOST effective approach to design and deployment?

• Implementing a single, complex API with strong encryption and multi-factor authentication, while requiring users to create 20-character passwords with a mix of uppercase and lowercase letters, numbers, and symbols.

• Utilizing a Service-Oriented Architecture (SOA) to leverage well-tested components, conducting a thorough attack surface analysis to identify and prioritize vulnerabilities, and designing user-friendly authentication processes that balance security with usability.

• Focusing primarily on securing the network infrastructure with a robust firewall and Intrusion Detection System (IDS), relying on default security settings of chosen software components, and prioritizing development speed over security considerations.

• Implementing all possible security measures, regardless of complexity or user impact, to achieve the highest level of theoretical security.

A security audit reveals that an older version of a customer relationship management (CRM) system has a significantly larger Relative Attack Surface Quotient (RASQ) compared to its latest version. Which of the following conclusions is the MOST accurate based on this finding?

• The older version is guaranteed to have more exploitable vulnerabilities.

• The older version requires immediate decommissioning, regardless of functionality.

• The newer version has likely undergone security improvements that reduced its potential attack vectors.

• The RASQ difference indicates that the newer version is completely immune to attacks.