OCTAVE CASENET Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A utility company is conducting an OCTAVE assessment. The team has completed the organizational view and is now in the technological view. They have identified that the customer billing system has a known vulnerability in its authentication module. What is the most appropriate action in this phase?

   • AInterview business managers to determine the financial impact of a billing system outage.
   • BImmediately deploy a patch to the authentication module without further analysis.
   • CDocument the vulnerability and evaluate how it could be exploited by threats to the billing system.
   • DDevelop a detailed remediation plan to patch the authentication module.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   According to OCTAVE, which of the following is considered a critical information asset?

   • AA backup tape that contains only public information
   • BA list of employee names and job titles that is posted on the company website
   • CA database containing customer personally identifiable information (PII)
   • DA publicly available marketing brochure
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An OCTAVE assessment team is working with a healthcare organization that stores electronic health records (EHRs). The team must identify critical assets and their relative importance. The organization has multiple systems, including the EHR system, a research database, and a public website. The team has limited time and must prioritize which asset to focus on. What should they do?

   • AIdentify the EHR system as the most critical asset because it contains sensitive patient data and is central to operations.
   • BFocus on the research database because it contains a larger volume of data.
   • CTreat all assets equally to avoid bias in the assessment.
   • DFocus on the public website because it is externally accessible and more likely to be attacked.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An e-commerce company is starting an OCTAVE assessment. The security team has listed several information assets: customer PII, payment card data, marketing analytics, and internal employee emails. The team must prioritize these assets for the risk assessment. Which asset should be treated as the most critical, and why?

   • AInternal employee emails, because they contain sensitive HR information.
   • BPayment card data, because its compromise could cause regulatory fines and reputational damage.
   • CMarketing analytics, because it drives revenue decisions and is used daily.
   • DCustomer PII, because it is the largest dataset in the company.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A defense contractor is conducting an OCTAVE assessment for its .NET-based project management system, which contains classified project data. The team identifies two threat scenarios: (1) a foreign intelligence service using spear-phishing to steal credentials, and (2) a malicious insider with legitimate access exfiltrating data via USB. The external threat has moderate likelihood and high impact; the insider threat has low likelihood but catastrophic impact. The company must decide where to invest limited security budget. Which decision best reflects OCTAVE's risk analysis and mitigation strategy?

   • AFocus solely on the external threat because it has higher likelihood, and accept the insider risk.
   • BPurchase cyber insurance to cover both threats and take no technical action.
   • CImplement multi-factor authentication (MFA) and USB port controls to address both threats, prioritizing based on risk level.
   • DFocus solely on the insider threat because the impact is catastrophic, and ignore the external threat.
   Reveal Solution Discussion Select an answer first