Author: Anonymous

Trellis Health’s new engineering director assumes that if nobody explicitly writes down a security or reliability requirement, the development team will naturally build the system to be reasonably secure and reliable anyway, since “that’s just good engineering.” True or False: this assumption holds up.

Trellis Health’s security team runs a resilience test suite against the scheduling feature’s login flow. The suite confirms the two-factor authentication feature works exactly as designed — but the team doesn’t stop there. They also probe the underlying implementation for ways an attacker could bypass or corrupt that same feature. Why does resilience testing go further than confirming a feature works?

A Nordholm Systems tech lead is surprised that static analysis — a tool the team runs on close to half its commits — gets a lukewarm reception when engineers are asked how much it actually contributes to the software’s security; most rate its impact as low. He’d assumed heavy usage meant the team valued it highly. What’s the likely cause of that mismatch?

Nordholm Systems’ release checklist leans hard on “ensure host and network security basics are in place” — it’s the item every team completes almost without fail. Yet when engineers are asked how much that item actually contributes to the software’s own security, not one of them rates it as high or very-high impact. Meanwhile, external and internal security audits — used far less consistently — are the release-phase activities rated most impactful. Which of the following are plausible explanations for the host/network finding? (Select all that apply.)

Vantage Cloud’s payments team suffers a breach traced to a specific flaw in how it handled API tokens. The engineering director insists the team not only patch it, but also write a new security requirement that encodes the fix, so the same class of defect can’t slip into future projects. A newer engineer on the team asks what idea this reflects. What’s the answer?

During a pre-launch security review of Northfield Retail’s checkout platform, the audit team finds a customer-profile page that renders a shopper’s saved display name straight into the HTML. A developer on the call argues it needs no special handling because the value came from Northfield’s own database and is therefore trusted — until the auditor points out that a display name saved months earlier is already firing a stored XSS payload in every visitor’s browser. What principle should have been applied?

Evaluate the formula  E=p(1-p)n  when p = 0.015, n = 907, round to five decimal places.

Which image below shows the proper positioning of the bevel when performing venipuncture?

When taking the pulse/heart rate of an animal, you count for  30 seconds. In that 30 seconds you palpate 8 beats. What is the the heart rate in beats per minute?

Match the appropriate degree of restraint to each restraint method listed below.