Security Maintenance and Monitoring CASENET Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a security-relevant event that should be logged in a .NET application?

   • AA user successfully changing their profile picture.
   • BA user entering an incorrect password multiple times.
   • CThe application displaying a welcome message to a logged-in user.
   • DA background job that cleans up temporary files.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A .NET application uses a third-party component that is no longer supported by the vendor. The component has a known critical vulnerability, but the application cannot be redesigned in the near term. The security team must reduce the risk while maintaining application functionality. Which approach is the most effective?

   • AImplement a compensating control, such as a Web Application Firewall rule that specifically blocks the attack pattern, and document the risk acceptance in the security maintenance plan.
   • BRemove the component from the application and rewrite the affected functionality using a different library.
   • CUpgrade the component to the latest version, even though the vendor no longer supports it, and hope that the vulnerability is fixed.
   • DDisable the component's features in the application configuration to prevent any use of the vulnerable code path.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a security maintenance plan for a .NET application?

   • ATo replace the need for security testing during the development phase by shifting all security activities to production.
   • BTo define a schedule, scope, and responsibilities for ongoing security activities such as patching, monitoring, and reviews.
   • CTo document only the initial deployment steps and configuration of the .NET application.
   • DTo provide a one-time checklist for responding to a single security incident.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A .NET application is subject to both GDPR and PCI DSS. The security team is designing a security maintenance plan. Which requirement must be prioritized?

   • AFocus only on GDPR because it has broader applicability.
   • BEnsure that all security maintenance activities are documented and evidence is retained for the required periods.
   • CDelay documentation until after the next audit to avoid conflicting requirements.
   • DPrioritize PCI DSS requirements over GDPR because PCI DSS has stricter technical controls.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it important for security maintenance activities to align with regulatory and organizational compliance requirements?

   • ATo avoid legal penalties and demonstrate due diligence in protecting sensitive data.
   • BTo reduce the need for regular security testing.
   • CTo allow developers to skip code reviews for faster releases.
   • DTo ensure that the application's user interface is consistent across all browsers.
   Reveal Solution Discussion Select an answer first