AP Cybersecurity Drill 26: Secure Defaults for a New App

Question 1. Reading the table, which shipped default already follows a secure-by-default approach?

• A) New accounts are created with full administrator permissions by default
• B) Transport encryption (TLS) is turned on by default ✓
• C) All network ports are open at install and closed later by the admin
• D) Input validation is off until the customer switches it on

Explanation: Choice B is correct. Transport encryption on by default means a customer who changes nothing still gets encrypted connections, which is exactly what a secure default looks like. Choice A is incorrect because making every new account a full administrator by default violates least privilege and is an insecure default. Choice C is incorrect because opening all ports at install exposes services until someone remembers to close them, so the safe state depends on later action. Choice D is incorrect because leaving validation off until it is switched on means the unconfigured app accepts unchecked input.

Question 2. The team wants new accounts to start with only the access a normal user needs, rather than full administrator rights. Which principle does that change apply?

• A) Defense in depth, which layers several independent controls so one failure is not total
• B) Open design, which assumes the design of a control can be public without weakening it
• C) Separation of duties, which splits a sensitive task so no single person completes it alone
• D) Least privilege, which grants each account only the access its role actually requires ✓

Explanation: Choice D is correct. Starting accounts with only the access the role requires, and nothing more, is the definition of least privilege. Choice A is incorrect because defense in depth is about layering multiple controls, not about how much access one account holds. Choice B is incorrect because open design concerns whether a mechanism stays secure when its design is known, a different idea. Choice C is incorrect because separation of duties divides one task across people, while this change is about limiting a single account's permissions.

Question 3. The setting for behavior when a security check errors out currently allows the request and continues. Which change makes this default fail securely?

• A) Log the error quietly in the background and let the request through so that users are never blocked
• B) Allow the request but show the user a banner noting that a check did not complete
• C) Deny the request by default when a security check cannot complete, then record the error ✓
• D) Retry the same security check several times and allow the request if any retry returns

Explanation: Choice C is correct. Failing securely means that when a control cannot finish, the system defaults to denying access rather than granting it, and the error is recorded for follow-up. Choice A is incorrect because letting the request through on error is failing open, the unsafe direction. Choice B is incorrect because a banner does not change that access was still granted while the check was incomplete. Choice D is incorrect because repeated retries that end in allowing the request still grant access when the check never truly passed.

Question 4. After launch, the team wants to notice quickly if an installation is still running with all ports open. Which approach would detect that condition?

• A) Add a sentence to the install guide telling admins to close unused ports
• B) Periodically scan each installation's open ports and flag any that expose unused services ✓
• C) Email customers a monthly reminder describing why open ports are risky and asking them to check their own settings
• D) Require a longer password on the administrator account during setup

Explanation: Choice B is correct. A periodic port scan that flags unused exposed services is a detective control: it surfaces the unsafe condition wherever it still exists. Choice A is incorrect because guidance in a document does not detect anything; it depends on the reader acting. Choice C is incorrect because a reminder email describes a general risk and asks the customer to look, but it does not detect the specific open-port condition on any installation. Choice D is incorrect because password length protects the admin account but reveals nothing about which ports are open.

Question 5. Considering the whole checklist, which single change would most reduce risk for a customer who installs the app and changes no settings?

• A) Switch every default to its safe value, so the unconfigured app starts in a protected state ✓
• B) Publish a hardening guide that lists each setting and the value the customer should choose
• C) Add a setup wizard that asks the customer to confirm each setting one screen at a time
• D) Keep the current defaults but display the riskiest ones in red on the settings page

Explanation: Choice A is correct. The customer in question changes nothing, so the protection that matters is the state the app ships in; setting every default to its safe value protects that customer automatically. Choice B is incorrect because a hardening guide only helps customers who read and apply it. Choice C is incorrect because a wizard still relies on the customer making the right choice at each screen. Choice D is incorrect because color-coding informs a customer who opens the settings page but does not change the unconfigured defaults.