Security Maintenance and Monitoring CASENET Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company operates a .NET application that is critical to business operations. The security maintenance plan must include monthly vulnerability scans, quarterly patch deployments, and an annual penetration test. However, the operations team is concerned that monthly scans may disrupt production performance, and the change advisory board requires a 2-week notice for any production change. The security team has a limited budget and cannot afford additional infrastructure. What is the most practical approach to balance security and operational constraints?

   • APerform the vulnerability scans manually during business hours to avoid automated tool costs, and apply patches only when a critical vulnerability is discovered.
   • BRun the vulnerability scans on a staging environment that mirrors production, and deploy patches to production without prior notice to avoid delays.
   • CSchedule the monthly vulnerability scans during off-peak hours using a scanning tool that supports non-intrusive scanning, and align the quarterly patch deployments with the change advisory board's 2-week notice period.
   • DReplace the monthly scans with the annual penetration test to reduce disruption, and skip the quarterly patches to save budget.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A multinational company's .NET application stores personal data of EU citizens. The GDPR requires that data breaches be reported to the supervisory authority within 72 hours. The security team is designing the incident response procedure. What must be included to meet this requirement?

   • AA list of all EU customers and their contact information so they can be notified of the breach.
   • BA policy that all security incidents are reported to the legal department within 72 hours, regardless of whether personal data is involved.
   • CA documented procedure for assessing whether a breach involves personal data, and a notification template that includes the required information for the supervisory authority.
   • DA backup and recovery plan that ensures the application can be restored within 72 hours of any incident.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst runs a vulnerability scan against a deployed .NET application and finds that the application uses an outdated version of a JavaScript library with a known cross-site scripting (XSS) vulnerability. The application is a legacy system that cannot be easily updated. What is the most appropriate mitigation?

   • AImplement a Content Security Policy (CSP) that restricts the execution of untrusted scripts and add output encoding in the application code where user input is reflected.
   • BDisable JavaScript in the users' browsers to prevent the vulnerable library from executing.
   • CRemove the JavaScript library from the application and rewrite all client-side functionality using server-side code.
   • DAdd a Web Application Firewall rule that blocks any request containing the library's name in the URL.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A .NET application uses a third-party library that has a known remote code execution vulnerability. The vendor has released a patch, but the patch requires a configuration change that may break existing functionality. What is the best approach?

   • ARemove the library from the application and rewrite the affected functionality from scratch.
   • BApply the patch directly to production and monitor for issues.
   • CSkip the patch and add a Web Application Firewall (WAF) rule to block exploitation attempts.
   • DApply the patch in a staging environment, test the configuration change, and then deploy to production after validation.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a best practice for managing security patches for a .NET application's dependencies?

   • AApply patches only when a security breach has already occurred.
   • BReplace all third-party libraries with custom code to avoid patching.
   • CDisable automatic updates to avoid any changes to the application.
   • DRegularly monitor vendor advisories and apply relevant patches in a timely manner.
   Reveal Solution Discussion Select an answer first