OCTAVE CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An OCTAVE assessment at a software company reveals that a .NET application has a high-risk vulnerability that could allow unauthorized data access. The company has limited budget and must choose a mitigation strategy. Which approach best aligns with OCTAVE's risk mitigation principles?

   • AAccept the risk because the vulnerability is only exploitable by authenticated users.
   • BAvoid the risk by removing the feature that contains the vulnerability.
   • CTransfer the risk by purchasing cyber insurance and taking no other action.
   • DImplement a compensating control that reduces the likelihood of exploitation while scheduling a permanent fix.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A software company has completed an OCTAVE assessment and identified that a .NET API exposes sensitive data due to missing authorization checks. The risk is rated high. The team is deciding on a mitigation strategy. Which option best aligns with OCTAVE's mitigation planning?

   • AAdd logging and monitoring to detect unauthorized access attempts.
   • BRate-limit the API to reduce the speed of automated attacks.
   • CDocument the risk as accepted because the API is internal.
   • DImplement role-based access control (RBAC) in the API and add unit tests to verify authorization.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the OCTAVE methodology, what is the primary purpose of identifying critical information assets?

   • ATo create a complete inventory of all hardware and software in the organization
   • BTo determine which assets require the most protection and focus risk assessment efforts
   • CTo assign monetary values to assets for quantitative risk analysis
   • DTo identify all potential vulnerabilities in the infrastructure
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the OCTAVE methodology, which phase focuses on identifying the organization's critical assets and their protection requirements?

   • AOrganizational view
   • BTechnological view
   • CRisk analysis
   • DStrategy and plan development
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is conducting an OCTAVE assessment and has completed the organizational view. The team is now in the technological view phase. Which activity best fits this phase?

   • AInterviewing executives to determine which assets are most critical to the business.
   • BDefining the organization's security policies and standards for acceptable use.
   • CCreating a risk mitigation plan that includes specific countermeasures and owners.
   • DReviewing network and system configurations to identify vulnerabilities that could be exploited by the identified threats.
   Reveal Solution Discussion Select an answer first