Security Maintenance and Monitoring CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's .NET application is subject to PCI DSS requirements. The security manager is creating a security maintenance plan and needs to ensure that all maintenance activities are documented and that responsibilities are clearly assigned. Which element is most critical to include in the plan?

   • AA description of the application's architecture and a diagram of the network topology.
   • BA list of all employees who have access to the production environment and their login credentials.
   • CA budget for purchasing new security tools and a timeline for migrating the application to a newer .NET framework.
   • DA schedule for quarterly vulnerability scans, a list of responsible personnel for each activity, and a process for documenting exceptions and remediation.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's .NET application is deployed across multiple regions. The security team must create a maintenance plan that includes vulnerability scanning, patching, and compliance reporting. The plan must minimize downtime and meet regional data residency requirements. Which plan is most appropriate?

   • AStore all compliance reports in the headquarters region for simplicity.
   • BSkip vulnerability scans in regions with low traffic to save costs.
   • CSchedule scans and patches per region during local off-peak hours, and store compliance reports in each region's designated data location.
   • DRun all scans and patches from a central location during a single global maintenance window.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of conducting regular vulnerability scans on a deployed .NET application?

   • ATo identify known security weaknesses in the application and its dependencies.
   • BTo measure the application's performance under heavy load.
   • CTo ensure that the application's code follows naming conventions.
   • DTo verify that all user interface elements are accessible to people with disabilities.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a common output of a vulnerability scan?

   • AA compiled version of the application ready for deployment.
   • BA detailed network diagram of the production environment.
   • CA list of all user passwords in plaintext.
   • DA list of vulnerabilities with severity ratings and remediation recommendations.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A .NET application experiences a suspected SQL injection attack. The security team needs to determine the scope of the breach and prevent further damage. Which incident response step should be performed first?

   • AIsolate the affected application instance from the network while preserving logs and memory for analysis.
   • BRebuild the application from the latest source code to ensure the vulnerability is removed.
   • CApply the latest security patches to the database server.
   • DNotify all users that their data may have been compromised.
   Reveal Solution Discussion Select an answer first