OCTAVE CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of a vulnerability that OCTAVE would assess?

   • AA fire destroying the data center
   • BA customer complaining about service quality
   • CA hacker attempting to breach the network
   • DA lack of security awareness training for employees
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has completed an OCTAVE assessment and identified that its .NET application's authentication mechanism is weak. The company decides to implement multi-factor authentication (MFA) as a mitigation. Which OCTAVE principle does this action best reflect?

   • ATransferring the risk to the MFA vendor.
   • BAccepting the risk because MFA is not foolproof.
   • CEliminating the asset that is at risk by removing the authentication feature.
   • DReducing the likelihood of unauthorized access by adding a control that makes exploitation harder.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company has completed an OCTAVE assessment and identified that a SQL injection vulnerability in their .NET web application poses a high risk to customer data. The team is now developing a mitigation strategy. Which approach best aligns with OCTAVE's strategy and plan development phase?

   • APrioritize remediation by implementing parameterized queries and input validation in the application code.
   • BIncrease the frequency of security testing to detect future SQL injection issues.
   • CDocument the risk and accept it because the application is scheduled for replacement next year.
   • DDeploy a web application firewall (WAF) as the sole mitigation without changing application code.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A media company is developing a new .NET content management system (CMS) that will store unpublished articles and subscriber data. The OCTAVE assessment has identified that the CMS is likely to be targeted by competitors seeking early access to articles. The risk is rated high. The team must choose a mitigation strategy that balances time-to-market with security. Which approach best aligns with OCTAVE?

   • ADelay the launch until all possible security features are implemented.
   • BLaunch the CMS as planned and conduct a full OCTAVE assessment after release.
   • CRemove the subscriber data feature from the CMS to reduce the attack surface.
   • DImplement strong access controls and encryption for unpublished content, and conduct security testing before launch.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A government agency is using OCTAVE to assess risks to its citizen portal. The team identifies that a hacktivist group could exploit a misconfigured web server to deface the portal, damaging public trust. The likelihood is moderate and the impact is high. What should the team document as the threat source and motivation?

   • AThreat source: competitor; motivation: competitive advantage.
   • BThreat source: disgruntled employee; motivation: revenge against the agency.
   • CThreat source: hacktivist group; motivation: political or ideological statement.
   • DThreat source: misconfigured web server; motivation: financial gain.
   Reveal Solution Discussion Select an answer first