OCTAVE CASENET Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   In the OCTAVE methodology, what is the focus of the vulnerability assessment step?

   • ADeveloping mitigation strategies
   • BDetermining the likelihood of threat occurrence
   • CIdentifying weaknesses in the organization's infrastructure and practices that could be exploited
   • DIdentifying the critical assets of the organization
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An OCTAVE assessment team is evaluating a .NET application that uses a custom authentication module. The team finds that the module has a vulnerability that allows brute-force attacks. The team also notes that the application is exposed to the internet. The team must decide on a mitigation strategy. What is the most effective approach?

   • AMove the application to a private network to reduce exposure.
   • BReplace the custom authentication module with a third-party solution.
   • CImplement account lockout and rate limiting on the authentication endpoint.
   • DIncrease the password complexity requirements to make brute-force attacks harder.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which phase of the SDLC would benefit most from applying OCTAVE risk assessment principles?

   • AMaintenance
   • BTesting
   • CRequirements gathering
   • DDeployment
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   During an OCTAVE assessment for a .NET e-commerce application, the team identifies that the application stores customer payment card data. They are now analyzing potential threat sources. Which threat source and motivation pairing is most relevant to this asset?

   • ACompetitors motivated by market advantage seeking to copy the application's business logic.
   • BDisgruntled employees motivated by revenge seeking to delete the application's source code.
   • CNation-state actors motivated by espionage seeking to monitor user browsing habits.
   • DExternal cybercriminals motivated by financial gain seeking to steal cardholder data.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An insurance company is conducting an OCTAVE risk analysis. The team has identified a threat scenario where a phishing attack could lead to unauthorized access to customer policy data. The likelihood is rated high because employees frequently click on suspicious links, and the impact is rated high because of regulatory penalties. What should the team do next?

   • ADocument the threat but defer analysis until more data is available.
   • BReclassify the asset as less critical to lower the impact rating.
   • CCalculate the risk level and compare it against the organization's risk tolerance to decide if mitigation is required.
   • DImmediately implement a new email filtering solution to reduce the likelihood of phishing.
   Reveal Solution Discussion Select an answer first