OCTAVE CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has completed an OCTAVE assessment and identified several risks to its .NET applications. The company has a limited security budget and must choose a mitigation strategy. One risk involves a legacy application that is difficult to patch, and another involves a new application with a known vulnerability that is easy to fix. What is the most effective way to allocate the budget?

   • AFix the new application only and defer the legacy application indefinitely.
   • BIgnore the legacy application risk because it is difficult to fix.
   • CFix the easy vulnerability in the new application and implement compensating controls for the legacy application.
   • DSpend the entire budget on the legacy application because it is harder to fix.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is considering using OCTAVE for its security risk assessment. The company has a mature security team and wants to ensure the assessment aligns with its existing security processes. The company also wants to involve business unit managers to understand operational impacts. Which aspect of OCTAVE is most relevant to this need?

   • AOCTAVE's requirement to use external consultants for all assessments.
   • BOCTAVE's provision of a fixed set of controls that must be implemented.
   • COCTAVE's focus on technical vulnerabilities only, ignoring business processes.
   • DOCTAVE's emphasis on workshops that bring together business and IT stakeholders to analyze risks.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare organization is conducting an OCTAVE assessment. The team has completed the organizational view, identifying patient records as a critical asset and cataloging current security practices. They are now about to begin the technological view. Which activity best fits this phase?

   • AInterviewing department heads about the business impact of losing patient records.
   • BDefining threat profiles for external attackers targeting patient data.
   • CDrafting a risk mitigation plan that includes new access controls for patient records.
   • DExamining the network architecture and system configurations that store or process patient records.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an OCTAVE assessment for a .NET application that handles credit card transactions, the team identifies a threat where an attacker could intercept traffic between the application and the payment gateway. What is the most relevant impact of this threat?

   • ALoss of availability of the payment gateway, causing transaction delays.
   • BReputation damage only, with no financial impact.
   • CUnauthorized disclosure of sensitive payment data, leading to financial fraud and regulatory penalties.
   • DModification of the application's source code, leading to malicious functionality.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A software development organization wants to integrate OCTAVE into its SDLC for .NET applications. The organization has multiple development teams and a centralized security team. They want to ensure that risk assessment is consistent across projects without slowing down development. Which approach best balances these concerns?

   • ACreate a lightweight OCTAVE-based risk assessment template that development teams complete during the design phase, with security team review.
   • BHave the security team conduct all OCTAVE assessments after development is complete.
   • CUse a single OCTAVE assessment for the entire organization and apply the results to all projects.
   • DRequire each development team to conduct a full OCTAVE assessment independently for every project.
   Reveal Solution Discussion Select an answer first