WGU 3

What is the primary goal of secure coding?

To ensure software functions correctly even under malicious attack

Which example best demonstrates a secure coding technique?

Allocating sufficient memory for user input to prevent buffer overflows

What is the primary security benefit of modularity?

Allows systems to be updated or secured independently

How does layering (defense in depth) improve security?

By using multiple independent security controls

Which principle ensures users and processes receive only the access they need?

Least privilege

What is the primary goal of confidentiality in software and component security?

Ensuring sensitive data is accessible only to authorized users or systems

Which security technique ensures that only authorized users can access specific data or system components?

Access control

Why is access control critical to maintaining confidentiality?

It limits who can view or interact with sensitive data

Which statement best describes encryption?

It converts plaintext into unreadable ciphertext

How does hashing support confidentiality?

By protecting sensitive data using one-way transformations

What is the key difference between data masking and tokenization?

Tokenization replaces data with a reversible token, while masking does not

Why is data masking especially useful in development and testing environments?

It reduces the risk of exposing sensitive information

What does integrity ensure in software and component security?

Data and software are not altered without authorization

How does validating user input support integrity?

By preventing malformed or malicious data from entering the system

What is the primary purpose of a checksum?

To verify that data has not been altered

How does code signing help maintain integrity?

It verifies that software code has not been modified

Which OWASP Top 10 vulnerability occurs when a web application makes unintended requests to internal or external systems?

Server-side request forgery (SSRF)

Why is input validation effective at preventing injection attacks such as SQL injection?

It ensures input conforms to valid syntax and meaning

Data vs Information?

Data = raw facts/values, no context. Information = data that's been processed and given meaning/context

IPsec definition

a protocol suite providing encryption and authentication for data at the network layer. Commonly secures VPN traffic.

What is the primary purpose of a database?

To organize data for efficient information retrieval

In which environment is an application primarily created, debugged, and modified?

Development

What security benefit does code signing provide?

It confirms the publisher's identity and code integrity

What is the primary goal of database security?

To prevent unauthorized data exposure

How do parameterized queries help protect against SQL injection?

They separate user input from query structure