{{asɛmtiNe Ɔkyerɛwfo}} | Nhomakorabea | Nneɛma a ɛma wotumi yɛ ade

1

What is the primary difference between considering security as a "technical feature" versus a "design principle" under the CISA Secure by Design initiative?

Security is treated as an add-on component to be configured by the IT department after the software is finished.

Security is integrated into every phase of the product development lifecycle, from initial planning to final deployment.

The software relies on the end-user to download and install security patches to fix vulnerabilities discovered after release.

Security is viewed as a series of compliance checkboxes that must be ticked before a product can be shipped to vendors.

1

A software company discovers a critical vulnerability in their platform. Instead of keeping it quiet to protect their stock price, they immediately publish a detailed advisory and share the technical details with the cybersecurity community. Which Secure by Design principle does this demonstrate?

Building organizational structure for security-first leadership.

Taking ownership of customer security outcomes.

Embracing radical transparency and accountability.

Developing products that meet specific customer security needs.

1

A hardware manufacturer releases a new Wi-Fi router. When a customer plugs it in for the first time, they find that high-strength encryption is already active, and the setup process requires them to change the unique, pre-set password. This is an example of:

User Input Sanitization.

Control Character Encasing.

Security-First Posture.

Secure by Default.

1

A developer is building a web form that asks users for their home address. To prevent a malicious actor from using a semicolon or a single quote to "break out" of the application's intended logic and run unauthorized commands, what process should the developer implement?

Ownership of customer outcomes.

Product news transparency.

User input sanitization.

Default feature enablement.

1

Which of the following describes the role of "control characters" like the single quote (') or semicolon (;) in application processing?

They are the functions used to verify that a user is a human and not a bot.

They are used by the application to encase and process user input but can be exploited if not handled correctly.

They are exclusively used by hackers to bypass firewalls and have no legitimate use in application code.

They are "safe" characters that should be automatically added to every user password to increase complexity.

1

An application developer writes a function that checks every username submitted during registration. If the function detects a character that could be used to manipulate the system's database, it automatically deletes that character before saving the name. What is this function doing?

It is sanitizing the input by removing potentially malicious characters.

It is enforcing a secure-by-default posture for the user's account.

It is using control characters to encrypt the user's registration data.

It is taking ownership of the customer's security outcomes by hiding errors.

1

A tech CEO decides to restructure the company so that the Chief Information Security Officer (CISO) reports directly to them and has a say in every new product roadmap. This action aligns with which Secure by Design principle?

Software should be secure to use out of the box.

Programmers should use functions to verify that user input meets expected criteria.

Sharing security-related news quickly increases security for everyone.

Companies should build organizational structure and leadership to implement security by design.

1

A user downloads a new messaging app and notices that "End-to-End Encryption" and "Multi-Factor Authentication" are already turned on in the settings menu without them having to do anything. Why does CISA encourage this "Secure by Default" approach?

It prevents the need for any future software updates or security patches.

It shifts the burden of security configuration from the manufacturer to the customer.

It allows the company to collect more data about the user's security habits.

It ensures that products are secure to use out of the box without requiring expert knowledge from the user.

1

If a programmer fails to verify user input and allows control characters to be processed by the system, what is the most likely security risk?

The application will automatically disable all "Secure by Default" settings.

The system could be manipulated or tricked into executing unauthorized commands.

The organization's leadership will lose its security-first posture.

The product will fail to meet the "Secure by Design" transparency requirement.

1

When implementing the "Secure by Design" principle of taking ownership of customer security outcomes, what should a company prioritize?

Building products that evolve to meet the actual security needs and challenges of their customers.

Investing in marketing campaigns that blame users for not configuring settings correctly.

Charging customers an extra fee to unlock the most secure version of the software.

Lowering the price of the product by removing complex security features.

AP Cybersecurity: 5.5A - CFUs

AP Cybersecurity: 5.5A - CFUs

What is the primary difference between considering security as a "technical feature" versus a "design principle" under the CISA Secure by Design initiative?

A software company discovers a critical vulnerability in their platform. Instead of keeping it quiet to protect their stock price, they immediately publish a detailed advisory and share the technical details with the cybersecurity community. Which Secure by Design principle does this demonstrate?

A hardware manufacturer releases a new Wi-Fi router. When a customer plugs it in for the first time, they find that high-strength encryption is already active, and the setup process requires them to change the unique, pre-set password. This is an example of:

A developer is building a web form that asks users for their home address. To prevent a malicious actor from using a semicolon or a single quote to "break out" of the application's intended logic and run unauthorized commands, what process should the developer implement?

Which of the following describes the role of "control characters" like the single quote (') or semicolon (;) in application processing?

An application developer writes a function that checks every username submitted during registration. If the function detects a character that could be used to manipulate the system's database, it automatically deletes that character before saving the name. What is this function doing?

A tech CEO decides to restructure the company so that the Chief Information Security Officer (CISO) reports directly to them and has a say in every new product roadmap. This action aligns with which Secure by Design principle?

A user downloads a new messaging app and notices that "End-to-End Encryption" and "Multi-Factor Authentication" are already turned on in the settings menu without them having to do anything. Why does CISA encourage this "Secure by Default" approach?

If a programmer fails to verify user input and allows control characters to be processed by the system, what is the most likely security risk?

When implementing the "Secure by Design" principle of taking ownership of customer security outcomes, what should a company prioritize?

What is the primary difference between considering security as a "technical feature" versus a "design principle" under the CISA Secure by Design initiative?

A software company discovers a critical vulnerability in their platform. Instead of keeping it quiet to protect their stock price, they immediately publish a detailed advisory and share the technical details with the cybersecurity community. Which Secure by Design principle does this demonstrate?

A hardware manufacturer releases a new Wi-Fi router. When a customer plugs it in for the first time, they find that high-strength encryption is already active, and the setup process requires them to change the unique, pre-set password. This is an example of:

A developer is building a web form that asks users for their home address. To prevent a malicious actor from using a semicolon or a single quote to "break out" of the application's intended logic and run unauthorized commands, what process should the developer implement?

Which of the following describes the role of "control characters" like the single quote (') or semicolon (;) in application processing?

An application developer writes a function that checks every username submitted during registration. If the function detects a character that could be used to manipulate the system's database, it automatically deletes that character before saving the name. What is this function doing?

A tech CEO decides to restructure the company so that the Chief Information Security Officer (CISO) reports directly to them and has a say in every new product roadmap. This action aligns with which Secure by Design principle?

A user downloads a new messaging app and notices that "End-to-End Encryption" and "Multi-Factor Authentication" are already turned on in the settings menu without them having to do anything. Why does CISA encourage this "Secure by Default" approach?

If a programmer fails to verify user input and allows control characters to be processed by the system, what is the most likely security risk?

When implementing the "Secure by Design" principle of taking ownership of customer security outcomes, what should a company prioritize?