D487 Secure Software Design - Set 3 - Part 1

Correct Answer: To ensure data confidentiality

Encryption is used to protect data by converting it into a format that can only be read by someone with the appropriate decryption key, ensuring its confidentiality.

Correct Answer: Denial of Service (DoS)

A Denial of Service attack aims to make a system or service unavailable by overwhelming it with traffic, preventing legitimate users from accessing it.

Correct Answer: Input validation

Input validation ensures that only properly formatted data is passed to the database, helping to prevent SQL injection attacks.

Correct Answer: Implementing multi-factor authentication

Multi-factor authentication adds an additional layer of security, making it more difficult for unauthorized users to gain access even if they have the password.

Correct Answer: To ensure operations continue during and after a disaster

A business continuity plan outlines procedures to ensure that essential functions can continue during and after a disaster, minimizing downtime.

Correct Answer: Man-in-the-Middle (MitM)

A Man-in-the-Middle attack occurs when an attacker secretly intercepts and relays messages between two parties, potentially altering the communication.

Correct Answer: To simulate attacks and identify vulnerabilities

Penetration testing involves simulating real-world attacks to discover vulnerabilities in systems and applications, helping organizations strengthen their security.

Correct Answer: Users should have only the minimum access necessary to perform their jobs

The principle of least privilege restricts user access rights to the bare minimum, reducing the risk of unauthorized access or accidental data exposure.

Correct Answer: Ransomware

Ransomware is designed to encrypt files on a victim’s system and demand a ransom for their decryption, causing significant disruptions.

Correct Answer: To outline the organization’s security approach and measures

A security policy serves as a framework for managing security, providing guidelines for employees on protecting sensitive data and resources.

Correct Answer: Virtual Private Network (VPN)

A VPN creates a secure connection over the internet, encrypting data and providing privacy for users accessing the network remotely.

Correct Answer: To filter and control incoming and outgoing traffic

Firewalls monitor and filter network traffic based on predetermined security rules, helping to protect the network from unauthorized access.

Correct Answer: Role-Based Access Control (RBAC)

RBAC restricts system access to authorized users based on their role within the organization, simplifying permission management.

Correct Answer: Manipulating individuals to divulge confidential information

Social engineering exploits human psychology to manipulate individuals into revealing sensitive information, often through deception.

Correct Answer: To detect and alert on potential security breaches

An IDS monitors network traffic for suspicious activities, helping organizations detect and respond to potential threats in real time.

Correct Answer: Worm

A worm is a type of malware that can replicate itself and spread to other computers without user intervention, often causing network disruptions.

Correct Answer: To prevent unauthorized data access and transfer

DLP solutions are designed to monitor and protect sensitive data from unauthorized access and transfer, ensuring that data remains secure.

Correct Answer: Regularly applying updates to software to fix vulnerabilities

Patch management involves identifying, testing, and installing updates to software to address security vulnerabilities and improve functionality.

Correct Answer: Legal penalties and fines

Organizations that fail to protect sensitive data may face legal consequences, including penalties and fines, as well as reputational damage.

Correct Answer: To increase awareness of security threats and best practices

Security awareness training helps employees recognize potential security threats and understand best practices for protecting organizational data.