OCTAVE CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A development team is adopting OCTAVE principles for a new .NET microservices project. The team wants to identify which services handle sensitive data and prioritize security efforts accordingly. Which OCTAVE concept should they apply first?

   • ARisk analysis to calculate the risk score for each service.
   • BVulnerability assessment to scan all services for known CVEs.
   • CThreat identification to list all possible attackers of the microservices.
   • DAsset identification to classify services based on the sensitivity of the data they process.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following best describes the OCTAVE methodology?

   • AA quantitative risk assessment framework that assigns dollar values to assets
   • BA technical vulnerability scanning tool used to identify system weaknesses
   • CA self-directed, qualitative risk assessment methodology that focuses on operational risk
   • DA compliance-driven audit framework that focuses on regulatory requirements
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A financial services firm is adopting OCTAVE for its first security risk assessment. The security team has identified customer financial records as the most critical asset and is now cataloging where these records are stored, processed, and transmitted. According to OCTAVE, what should the team do next to ensure the assessment remains focused on the organization's most important concerns?

   • AImmediately implement encryption for all customer financial records in transit and at rest.
   • BExpand the asset inventory to include all physical and intangible assets across the organization.
   • CMove the customer financial records to a private cloud to reduce exposure.
   • DIdentify the threats and vulnerabilities that could affect the customer financial records.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of a risk mitigation strategy in OCTAVE?

   • ADocumenting the impact of a threat scenario
   • BIdentifying the critical assets of the organization
   • CEvaluating the likelihood of a threat scenario
   • DImplementing multi-factor authentication for critical systems
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An OCTAVE team has identified a threat scenario involving a disgruntled employee who could misuse their legitimate access to a .NET application to modify financial records. The team rates the likelihood as medium and the impact as high. What is the most appropriate risk response?

   • AImplement stricter access controls and monitoring for sensitive transactions.
   • BIgnore the risk because insider threats are rare.
   • COutsource the application hosting to reduce the risk.
   • DTerminate all employees who have access to the application.
   Reveal Solution Discussion Select an answer first