IT186: Secure Programming Practices
Midterm Exam
1. Which situation MOST directly violates Confidentiality?
A. A system crashes during peak usage
B. A user modifies data they are not authorized to change
C. Sensitive data is exposed to unauthorized users
D. Logs overwrite after 24 hours
2. Which actions help maintain Integrity?
Select ALL That Apply
o
o
o
o
o
Hashing data to detect tampering
Encrypting data at rest
Preventing unauthorized data modification
Ensuring systems are always online
Using access controls for write operations
3. A system assumes that any request coming from the internal network is
trustworthy and does not re-check permissions. Which principle is being
violated?
A. Secure by Default
B. Reluctance to Trust
C. Economy of Design
D. Transparency
4. Match the failure to the AAA concept it MOST directly impacts.
Failure
Concept
AAA
1. Users can perform actions outside their role
2. System cannot determine who performed an action
3. User identity is never verified
_______
_______
_______
Options:
A. Authentication
B. Authorization
C. Auditing
5. At which SDLC phase should you think about security?
A. Requirements
B. Design
C. Development
D. All of the Above
6. Which item is MOST likely an attack surface?
A. Encrypted database backups
B. Internal documentation
C. A public API endpoint
D. Archived logs
7. Which questions are asked during threat modeling?
o
o
o
o
o
What assets need protection?
Where can attackers interact with the system?
How much revenue will this generate?
What could go wrong?
How can we reduce risk?
8. Which combination determines threat priority?
A. Cost and complexity
B. Likelihood and impact
C. Popularity and exposure
D. Speed and performance
9.Match each scenario to the MOST appropriate STRIDE category.
Scenario
STRIDE
1. An attacker pretends to be a legitimate user
2. Logs are missing, making actions untraceable
3. A system becomes unavailable due to traffic overload
4. Sensitive data is exposed during transmission
________
________
________
________
Options:
A. Information Disclosure
B. Repudiation
C. Denial of Service
D. Spoofing
Which STRIDE threat category is MOST directly mitigated by encryption of
data in transit?
A. Spoofing
B. Information Disclosure
C. Denial of Service
D. Elevation of Privilege
11. A system component that has legitimate administrative authority
performs a privileged action after receiving a request from a less-trusted or
compromised component, without verifying that the requester is authorized
to perform that action.
Which security anti-pattern BEST describes this situation?
A. Backflow of Trust
B. Confused Deputy
C. Third-Party Hooks
D. Unpatchable Components
12. Match the Secure Programming Pattern to its purpose
Pattern
Purpose
1. Complete Mediation
________
2. Least Privilege
________
3. Defense in Depth
________
Options:
A. Multiple independent security layers
B. Limit access to minimum required
C. Authorization checked every time
13. Which secure design pattern MOST directly prevents unchecked lateral
movement?
A. Economy of Design
B. Avoid Predictability
C. Complete Mediation
D. Transparent Design
14. Why are parameterized queries effective against SQL injection?
A. They escape dangerous characters
B. They separate code from data
C. They encrypt user input
D. They block all user input
15. Which practices reduce injection risk?
o
o
o
o
o
Allowlisting valid inputs
Escaping characters manually
Parameterized queries
Input validation
Shared admin credentials
16. Which mitigation is LEAST reliable on its own?
A. Allowlisting
B. Parameterized queries
C. Manual escaping
D. Input validation
17. Which cryptographic technique provides data integrity but not
confidentiality?
A. Encryption
B. Hashing
C. Digital certificates
D. Key exchange
18. In asymmetric encryption, anyone with the public key can decrypt the
message.
☐ True
☐ False
19. Matching — Cryptography Use
Scenario
Technique
1. Verifying a file has not been altered
_________
2. Securely exchanging data over a network
_________
3. 3. Protecting stored sensitive data
_________
Options:
A. Hashing
B. Encryption in transit
C. Encryption at rest
20. Which situation MOST requires secure key handling?
A. Compressing files
B. Logging system errors
C. Encrypting stored user data
D. Displaying error messages