Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A .NET web application currently requires users to enter a complex password and a one-time code sent via SMS for every login. User feedback indicates this process is too cumbersome, and the product owner wants to reduce friction. Which change best balances security and functionality?

   • AKeep the one-time code but allow users to select 'Remember this device' for 30 days.
   • BReplace the complex password with a simple four-digit PIN.
   • CKeep the current process unchanged because any reduction in security is unacceptable.
   • DRemove the one-time code and rely on the complex password alone.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has a .NET web application that is accessible both internally and externally. The security team is conducting a risk assessment and needs to prioritize threats. Which threat should be considered the highest risk?

   • AAn external attacker exploiting a known vulnerability in a public-facing feature that has no compensating controls.
   • BAn external attacker performing a denial-of-service attack on the company's website.
   • CAn insider accidentally sharing sensitive data via a misconfigured email client.
   • DAn insider using their legitimate access to view customer data without authorization.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of threat modeling in application security?

   • ATo ensure the application meets functional requirements
   • BTo identify potential entry points and threats to the application
   • CTo replace the need for penetration testing
   • DTo write more efficient code
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's web application uses an open-source library for image processing. The library has a known critical vulnerability, but the team has not updated it because the update changes the API and would require significant code changes. An attacker exploits the vulnerability to execute arbitrary code. What is the most effective way to prevent this class of vulnerability in the future?

   • ADisable the image processing feature entirely
   • BRemove all third-party libraries and rewrite the functionality in-house
   • CAdd a web application firewall to block exploitation attempts
   • DImplement a process to regularly monitor and update third-party dependencies
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the best practice for managing third-party components to reduce security risks?

   • AUse as many third-party libraries as possible
   • BOnly use libraries that are popular
   • CRegularly update and patch all dependencies
   • DAvoid all third-party code
   Reveal Solution Discussion Select an answer first