Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A .NET application is being developed using an agile methodology with frequent releases. The team wants to integrate security into the development process without slowing down the release cycle. Which approach is most effective?

   • ADefer all security activities until after the application is fully developed.
   • BPerform a comprehensive security review only before major releases.
   • CRely on the development team to manually test for security issues during each sprint.
   • DIncorporate automated security scanning into the CI/CD pipeline and conduct threat modeling at the start of each sprint for new features.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A .NET application uses a third-party library for PDF generation. The library is several years old and has known vulnerabilities, but the development team has not updated it because the upgrade requires changes to the application code. What is the most appropriate action to reduce the risk from this outdated component?

   • AUse a different third-party library that is not patched either but has fewer known vulnerabilities.
   • BPlan and perform the upgrade to a patched version of the library, allocating time for necessary code changes and regression testing.
   • CKeep the old library but add input validation to prevent exploitation of the known vulnerabilities.
   • DRemove the library and write custom PDF generation code from scratch.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A software company is about to release a new version of its application. The release includes a new authentication module and updates to several third-party libraries. The team is concerned about introducing vulnerabilities during deployment. Which action is most effective in reducing deployment-related security risks?

   • ADeploy the application to production immediately to get user feedback
   • BRely on the development team's testing to ensure security
   • CDisable all security features temporarily to speed up the deployment
   • DPerform a security-focused review of the deployment configuration and run a vulnerability scan on the new libraries
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   At which stage of the software development lifecycle can vulnerabilities be introduced?

   • AOnly during the coding phase
   • BOnly during the testing phase
   • CAt any stage, from design through deployment
   • DOnly during the deployment phase
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An employee at a company receives an email that appears to be from the IT department, asking them to verify their password by clicking a link. The employee clicks the link and enters their credentials on a fake login page. Which type of threat does this scenario illustrate?

   • ASocial engineering, where the attacker manipulates a human to reveal credentials.
   • BAn insider threat, because the employee is inside the company.
   • CA brute-force attack against the login form.
   • DA misconfiguration in the application's authentication system.
   Reveal Solution Discussion Select an answer first