Join the discussion
Question 28/63
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
Correct Answer: C
The type of threat described is Tampering. This threat occurs when an attacker intercepts and manipulates data being sent from the client to the server, such as formdata being submitted to an API. The attacker may alter the data to change the intended operation, inject malicious content, or compromise the integrity of the system. Tampering attacks are a significant concern in secure software design because they can lead to unauthorized changes and potentially harmful actions within the application.
References:
* Understanding the different types of API attacks and their prevention1.
* Comprehensive guide on API security and threat mitigation2.
* Detailed analysis of Man-in-the-Middle (MitM) attacks and their impact on API security3.
References:
* Understanding the different types of API attacks and their prevention1.
* Comprehensive guide on API security and threat mitigation2.
* Detailed analysis of Man-in-the-Middle (MitM) attacks and their impact on API security3.
Add Comments
- Other Question (63q)
- Q1. A new product does not display personally identifiable information, will not let private d...
- Q2. Due to positive publicity from the release of the new software product, leadership has dec...
- Q3. Which threat modeling step collects exploitable weaknesses within the product?...
- Q4. What is an advantage of using the Agile development methodology?...
- Q5. While performing functional testing of the new product from a shared machine, a QA analyst...
- Q6. Which step in the change management process includes modifying the source code?...
- Q7. Developers have finished coding, and changes have been peer-reviewed. Features have been d...
- Q8. Company leadership has contracted with a security firm to evaluate the vulnerabilityofall ...
- Q9. During fuzz testing of the new product, random values were entered into input elements Sea...
- Q10. Which secure coding best practice ensures sensitive information is not disclosed in any re...
- Q11. The scrum team decided that before any change can be merged and tested, it must be looked ...
- Q12. Automated security testing was performed by attempting to log in to the new product with a...
- Q13. Which DREAD category is based on how easily a threat exploit can be found?...
- Q14. Which category classifies identified threats that do not have defenses in place and expose...
- Q15. Which software control test examines an application from a user perspective by providing a...
- Q16. Which secure coding best practice says to require authentication before allowing any files...
- Q17. What are the three primary goals of the secure software development process?...
- Q18. What refers to the review of software source code by developers other than the original co...
- Q19. What is a countermeasure to the web application security frame (ASF) data validation/param...
- Q20. Which type of security analysis is limited by the fact that a significant time investment ...
- Q21. The security team is identifying technical resources that will be needed to perform the fi...
- Q22. What are the three primary goals of the secure software development process?...
- Q23. The security testing team received a report from one of the contracted penetration testing...
- Q24. What is the protection of information and information systems from unauthorized access, us...
- Q25. A security architect is creating a data flow diagram and draws an arrow between two circle...
- Q26. Which DKEAD category has a risk rating based on the threat exploit's potential level of ha...
- Q27. Which threat modeling step assigns a score to discovered threats?...
- Q28. Which type of threat exists when an attacker can intercept and manipulate form data after ...
- Q29. Which secure coding best practice says to use well-vetted algorithms to ensure that the ap...
- Q30. The scrum team decided that before any change can be merged and tested, it must be looked ...
- Q31. Which privacy impact statement requirement type defines processes to keep personal informa...
- Q32. What sitsbetween a browser and an internet connection and alters requests and responses in...
- Q33. What is a countermeasure to the web application security frame (ASF) authentication threat...
- Q34. A public library needs to implement security control on publicly used computers to prevent...
- Q35. Recent vulnerability scans discovered that the organization's production web servers were ...
- Q36. Which privacy impact statement requirement type defines how personal information will be p...
- Q37. In which step of the PASTA threat modeling methodology is vulnerability and exploit analys...
- Q38. Which mitigation technique can be used to light against a threat where a user may gain acc...
- Q39. While performing functional testing of the new product from a shared machine, a QA analyst...
- Q40. Using a web-based common vulnerability scoring system (CVSS) calculator, a security respon...
- Q41. While performing functional testing of the new product from a shared machine, a QA analyst...
- Q42. Due to positive publicity from the release of the new software product, leadership has dec...
- Q43. An individual is developing a software application that has a back-end database and is con...
- Q44. Which SDL security goal is defined as ensuring timely and reliable access to and use of in...
- Q45. A recent vulnerability scan uncovered an XML external entity (XXE) Haw that could allow at...
- Q46. Which type of threat exists when an attacker can intercept and manipulate form data after ...
- Q47. Which secure coding best practice says to assume all incoming data should be considered un...
- Q48. Which threat modeling step collects exploitable weaknesses within the product?...
- Q49. Which secure coding best practice says to only use tested and approved components and use ...
- Q50. The organization has contracted with an outside firm to simulate an attack on the new soft...
- Q51. During fuzz testing of the new product, random values were entered into input elements Sea...
- Q52. Which type of security analysis is performed by reviewing source code line-by-line after o...
- Q53. The organization is moving from a waterfall to an agile software development methodology, ...
- Q54. A new product does not display personally identifiable information, will not let private d...
- Q55. The security team contracts with an independent security consulting firm to simulate attac...
- Q56. Which SDL security goal is defined as ensuring timely and reliable access to and use of in...
- Q57. What is the privacy impact rating of an application that stores personally identifiable in...
- Q58. The security team is reviewing whether changes or open issues exist that would affect requ...
- Q59. Which type of security analysis is performed by injecting malformed data into open interfa...
- Q60. Which secure software design principle assumes attackers have the source code and specific...
- Q61. Which architecture deliverable identifies the organization's tolerance to security issues ...
- Q62. Which secure coding best practice says to use a single application-level authorization com...
- Q63. An individual is developing a software application that has a back-end database and is con...
[×]
Download PDF File
Enter your email address to download WGU.Secure-Software-Design.v2026-07-14.q63.pdf
