Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A .NET web application was developed quickly with minimal security testing. After deployment, a security audit reveals that the application has several vulnerabilities, including insecure deserialization and missing input validation. At which stage of the software development lifecycle were these vulnerabilities most likely introduced?

   • ADuring the deployment phase, due to server misconfiguration.
   • BDuring the design phase, due to an inadequate threat model.
   • CDuring the testing phase, because the testers failed to find the vulnerabilities.
   • DDuring the coding phase, due to insecure coding practices and lack of security awareness.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A .NET application includes a NuGet package that has a known critical vulnerability. The package is used in a feature that processes user-uploaded files. Which action is the most effective way to mitigate the risk?

   • AUpdate the NuGet package to a patched version that is compatible with the application.
   • BAdd a check to reject files over a certain size.
   • CDisable the file upload feature temporarily.
   • DUse a different package that has no known vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A .NET application uses a third-party component that has a known remote code execution vulnerability. The vendor has released a patch, but applying it requires upgrading to a new major version that changes several APIs used by the application. The application is scheduled for a major release in two weeks. What is the best course of action?

   • AApply the upgrade immediately, even if it means delaying the release, because the vulnerability poses a critical risk.
   • BDefer the upgrade until after the release to avoid delaying the schedule.
   • CApply a temporary workaround, such as input validation, and upgrade after the release.
   • DRemove the third-party component and rewrite the affected functionality using built-in .NET features.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial services company has a .NET web application that handles customer transactions. The security team is assessing the risk of both external attackers and insider threats. Which scenario best illustrates an insider threat exploiting an application weakness?

   • AA competitor launches a denial-of-service attack against the company's public website.
   • BA disgruntled employee uses their valid credentials to access customer data through a misconfigured API endpoint that lacks proper authorization checks.
   • CAn external attacker exploits a SQL injection vulnerability in the login form to bypass authentication.
   • DA hacker uses a phishing email to trick an employee into revealing their password.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A developer at a company is responsible for maintaining a .NET web application. The developer is overworked and often copies code snippets from online forums without fully understanding them. Which outcome is most likely to occur?

   • AThe developer will not introduce any vulnerabilities because the .NET framework automatically sanitizes all inputs.
   • BThe developer will inadvertently introduce vulnerabilities because the copied code may contain insecure patterns or be incompatible with the application's security context.
   • CThe developer will improve the application's security because the code from forums is often more secure than the existing code.
   • DThe developer will be protected by the company's code review process, which catches all issues.
   Reveal Solution Discussion Select an answer first