Security & Error Handling Flashcards

What is the purpose of code signing?

Answer: Applying a digital signature to code so recipients can verify its authenticity and integrity

Code signing uses a private key to sign binaries; users verify with the public key that the software hasn't been tampered with and comes from a trusted source.

What is the fail-fast principle in error handling?

Answer: Detecting and reporting errors as early as possible rather than propagating invalid state deeper into the system

Fail-fast surfaces bugs immediately at their source before corrupted state propagates, making root cause analysis far easier.

What is a security audit in the context of software development?

Answer: A systematic review of code and architecture to identify security vulnerabilities and compliance gaps

A security audit examines code, configurations, and architecture to find vulnerabilities before attackers do, often including manual review and automated scanning.

What is the role of a circuit breaker pattern in distributed systems?

Answer: Detecting repeated failures in a service call and short-circuiting requests to prevent cascading failures

The circuit breaker pattern stops calling a failing service temporarily, allowing it to recover and preventing the caller from blocking on timeouts.

What is the principle behind 'defense in depth' in security?

Answer: Using multiple independent security controls so that if one layer is breached, others still protect the system

Defense in depth layers security controls (authentication, authorization, encryption, firewalls, monitoring) so no single failure exposes the entire system.

What is the purpose of exception handling best practice of 'catching specific exceptions'?

Answer: To handle each error type appropriately and avoid silently swallowing unexpected errors

Catching specific exception types lets you respond correctly to each situation; catching generic Exception may mask bugs by handling all errors the same way.