Secure Deployment and Maintenance CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which action is an example of secure configuration management for a Java runtime environment?

   • AUsing the default JVM heap size for all applications regardless of workload
   • BDisabling the JVM's classpath verification to improve startup time
   • CSetting the Java security manager to allow all permissions for the application
   • DConfiguring the JVM to use a secure random number generator for cryptographic operations
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A DevOps team is responsible for a Java microservice that uses a third-party library for XML parsing. A critical vulnerability (CVE) is announced for that library, and the vendor releases a patched version. The team's deployment pipeline builds a Docker image from a base image that is updated monthly. The security policy requires that production images are patched within 48 hours of a critical CVE announcement. What should the team do to meet this requirement?

   • AApply the patch directly to the running container using a shell command and commit the container as a new image
   • BUpdate the base image in the Dockerfile and rebuild the application image immediately
   • CWait for the next monthly base image update and then rebuild the application image
   • DUpdate the library version in the build configuration file and trigger a new build of the application image
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which step is essential before applying a security patch to a Java application in production?

   • ATesting the patch in a staging environment that mirrors production
   • BDeleting all application logs to free up space
   • CImmediately applying the patch to all production servers without prior testing
   • DDisabling the application's authentication to speed up the process
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Java application's monitoring system generates a large number of alerts, many of which are false positives. The security team is concerned that real incidents may be missed. What is the most effective way to improve the alert quality?

   • AIncrease the alert thresholds to very high levels so only the most severe events trigger alerts.
   • BDisable all alerts that have produced false positives in the past.
   • CTune the alert thresholds and rules based on historical data to reduce false positives while maintaining detection of genuine threats.
   • DAssign more analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A Java application's dependency management system identifies a critical vulnerability in a library that is used in multiple modules. The library's latest version is not backward compatible and requires code changes. The application is in production and cannot be taken offline for an extended period. What is the most appropriate strategy?

   • AApply a temporary mitigation, such as a WAF rule, while developing and testing the code changes required for the upgrade.
   • BUpgrade the library immediately without testing to eliminate the vulnerability.
   • CRemove the library and rewrite all affected code immediately.
   • DKeep the vulnerable version and document the risk as accepted.
   Reveal Solution Discussion Select an answer first