146 Chapter 6 ■ Security Assessment and Testing (Domain 6)
For questions 79–81, please refer to the following scenario:Ben’s organization has begun to use STRIDE to assess its software and has identified
threat agents and the business impacts that these threats could have. Now they are
working to identify appropriate controls for the issues they have identified.- Ben’s development team needs to address an authorization issue, resulting in an elevation
of privilege threat. Which of the following controls is most appropriate to this type of
issue?
A. Auditing and logging is enabled.
B. Role-based access control is used for specific operations.
C. Data type and format checks are enabled.
D. User input is tested against a whitelist. - Ben’s team is attempting to categorize a transaction identification issue that is caused by
use of a symmetric key shared by multiple servers. What STRIDE category should this
fall into?
A. Information disclosure
B. Denial of service
C. Tampering
D. Repudiation - Ben wants to prevent or detect tampering with data. Which of the following is not an
appropriate solution?
A. Hashes
B. Digital signatures
C. Filtering
D. Authorization controls - Chris is troubleshooting an issue with his organization’s SIEM reporting. After analyzing
the issue, he believes that the timestamps on log entries from different systems are incon-
sistent. What protocol can he use to resolve this issue?
A. SSH
B. FTP
C. TLS
D. NTP - Ryan is considering the use of fuzz testing in his web application testing program. Which
one of the following limitations of fuzz testing should Ryan consider when making his
decision?
A. They often find only simple faults.
B. Testers must manually generate input.
C. Fuzzers may not fully cover the code.
D. Fuzzers can’t reproduce errors.