OCTAVE CASENET Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An OCTAVE team is assessing a .NET application that allows users to upload files. The team identifies a threat where an attacker could upload a malicious file that executes on the server. The team also discovers that the application does not validate file types. The team must decide how to respond. What is the most appropriate mitigation?

   • AImplement file type validation and store uploaded files in a location with no execution permissions.
   • BAdd a warning message to the upload page advising users not to upload malicious files.
   • CDisable the file upload feature entirely to eliminate the threat.
   • DAccept the risk because the application is behind a firewall.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is adopting OCTAVE to improve the security of their .NET applications. They want to integrate risk assessment into their software development lifecycle (SDLC). Which practice best reflects this integration?

   • ARun a single OCTAVE assessment at the end of the project to document risks for the audit team.
   • BUse OCTAVE only for infrastructure assessments and rely on separate threat modeling for applications.
   • CReplace all security testing with OCTAVE assessments to reduce duplication of effort.
   • DConduct an OCTAVE-style asset and threat analysis during the design phase of each new application.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A telecommunications company is performing an OCTAVE technological view. The team discovers that the customer-facing .NET web application has a critical remote code execution (RCE) vulnerability, but the vendor has not yet released a patch. The application cannot be taken offline because it is revenue-generating. What is the most appropriate mitigation strategy?

   • AAccept the risk because no patch is available.
   • BDisable the application's internet-facing interface and require VPN access for all users.
   • CTake the application offline immediately to eliminate the vulnerability.
   • DImplement a web application firewall (WAF) rule to block exploit attempts and monitor for signs of compromise while awaiting the vendor patch.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a threat source in the OCTAVE context?

   • AAn unpatched operating system
   • BA firewall misconfiguration
   • CA disgruntled employee with access to sensitive data
   • DA lack of encryption on a database
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of risk analysis in the OCTAVE methodology?

   • ATo identify all possible vulnerabilities in the system
   • BTo eliminate all risks from the organization
   • CTo assign a monetary value to each risk
   • DTo prioritize risks based on their likelihood and impact
   Reveal Solution Discussion Select an answer first