CSSLP · Question #386
Which of the following is the most important task when performing a design security review?
The correct answer is B. Decompose your application and be able to identify key items.. Decomposing an application and identifying its key components is the most crucial task during a design security review to understand potential attack surfaces and vulnerabilities.
Question
Which of the following is the most important task when performing a design security review?
Options
- AAttach performance metrics to the review process.
- BDecompose your application and be able to identify key items.
- CHighlight all security controls used in the system.
- DUse standardized graphics to document the data flow.
How the community answered
(51 responses)- A2% (1)
- B92% (47)
- C2% (1)
- D4% (2)
Why each option
Decomposing an application and identifying its key components is the most crucial task during a design security review to understand potential attack surfaces and vulnerabilities.
Attaching performance metrics is related to operational efficiency, not the fundamental security review of a design.
During a design security review, decomposing the application into its constituent parts, such as services, data flows, and trust boundaries, is essential to understand its architecture and identify critical assets and interaction points. This breakdown allows for a thorough analysis of potential threats and vulnerabilities within the system's design.
Highlighting security controls is a subsequent step after understanding the system's components and identifying areas where controls are needed.
Using standardized graphics aids documentation but is not the most important analytical task for identifying design security flaws.
Concept tested: Design security review methodology
Source: https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-decompose-application
Topics
Community Discussion
No community discussion yet for this question.