CRISC · Question #206
Which of the following is the MOST effective way 10 identify an application backdoor prior to implementation'?
The correct answer is C. Source code review. The most effective way to identify an application backdoor before implementation is through a comprehensive source code review.
Question
Which of the following is the MOST effective way 10 identify an application backdoor prior to implementation'?
Options
- AUser acceptance testing (UAT)
- BDatabase activity monitoring
- CSource code review
- DVulnerability analysis
How the community answered
(47 responses)- A11% (5)
- B4% (2)
- C79% (37)
- D6% (3)
Why each option
The most effective way to identify an application backdoor before implementation is through a comprehensive source code review.
User acceptance testing (UAT) focuses on validating functional requirements from an end-user perspective and is not designed to uncover hidden malicious code or backdoors within the system's underlying logic.
Database activity monitoring tracks and logs interactions with a database during runtime, meaning it would only detect a backdoor if it were actively used post-implementation, not prior to deployment.
A source code review involves a detailed, line-by-line examination of the application's underlying code, which allows security professionals to directly uncover hidden functionalities, intentional malicious code, or backdoors that might not be detectable through black-box testing. This method provides the deepest insight into the application's true behavior before it is deployed.
Vulnerability analysis typically involves scanning for known vulnerabilities, misconfigurations, or common exploits, which might not detect a custom-developed or uniquely embedded backdoor that doesn't trigger known signatures.
Concept tested: Proactive backdoor detection via code review
Source: https://learn.microsoft.com/en-us/azure/security/develop/security-code-review
Topics
Community Discussion
No community discussion yet for this question.