OCTAVE CASENET Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A manufacturing company is performing an OCTAVE technological view. The team is reviewing the SCADA system that controls production. They find that the system runs on an outdated operating system and that vendor patches are not applied regularly. What is the most appropriate way to document these findings?

   • AAs threats originating from external attackers with a motivation to disrupt production.
   • BAs vulnerabilities in the infrastructure that could be exploited by threats targeting production availability.
   • CAs risks that have already been mitigated by the existing security controls.
   • DAs critical assets that require additional investment in monitoring.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An OCTAVE assessment team has identified a threat scenario where an attacker exploits a SQL injection vulnerability in a .NET web application to access a customer database. The team rates the likelihood as high and the impact as severe. According to OCTAVE, what should the team do next?

   • ADocument the risk and develop a mitigation plan that includes input validation and parameterized queries.
   • BMove to the next threat scenario without further analysis because the risk is already clear.
   • CReclassify the asset as non-critical to reduce the risk rating.
   • DImmediately shut down the web application to eliminate the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In OCTAVE risk analysis, what two factors are primarily evaluated to determine risk?

   • AVulnerability and threat source
   • BProbability and exposure
   • CAsset value and cost of mitigation
   • DLikelihood and impact
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An OCTAVE team is analyzing risks for a .NET application that provides online banking services. They identify two threat scenarios: (1) a distributed denial-of-service (DDoS) attack that could make the service unavailable, and (2) a SQL injection vulnerability that could expose customer account data. The team has limited resources and must decide which risk to address first. What should they do?

   • AAddress the SQL injection first because it is a technical vulnerability that is easier to fix.
   • BCompare the likelihood and impact of both scenarios to determine which poses the greater risk to the organization.
   • CAddress both simultaneously by allocating equal resources to each.
   • DAddress the DDoS attack first because availability is always more important than confidentiality.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A fintech startup is conducting an OCTAVE assessment for its .NET-based payment processing platform. The platform handles cardholder data and is subject to PCI DSS. The team has identified two major threat scenarios: (1) an external attacker exploiting a known vulnerability in a third-party component to steal card data, and (2) an insider abusing privileged access to modify transaction records. The external attack has a high likelihood and high impact; the insider threat has low likelihood but very high impact. The company has limited budget and must prioritize mitigation. Which approach best aligns with OCTAVE's risk analysis and mitigation strategy?

   • AMitigate the insider threat first because it is easier to implement technical controls.
   • BAccept both risks because the company is small and cannot afford mitigation.
   • CPrioritize mitigation of the external attack because it has high likelihood and high impact, while implementing compensating controls for the insider threat.
   • DFocus exclusively on the insider threat because its impact is very high, ignoring the external attack.
   Reveal Solution Discussion Select an answer first