Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's application was attacked. The investigation shows that the attacker used a known exploit for a publicly disclosed vulnerability in the application's web server. The vulnerability had a patch available, but the company had not applied it. Which threat source is most likely?

   • AInsider threat with privileged access
   • BThird-party component failure
   • CSocial engineering attack
   • DExternal attacker exploiting an unpatched vulnerability
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A startup is launching a new .NET web application. To speed up development, the team decides to skip security reviews and use default configurations. Which statement best describes the likely consequence?

   • AThe application will be secure because the .NET framework has built-in security that protects against all threats.
   • BThe application will be more secure because fewer changes are made to the default settings.
   • CThe application will only be vulnerable to insider threats, not external attackers.
   • DThe application will likely contain vulnerabilities due to insecure coding practices and misconfigurations that could have been caught by security reviews.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is comparing the risk posed by external attackers versus insider threats for a .NET web application. Which statement correctly differentiates between the two?

   • AInsider threats often have legitimate access and may exploit application weaknesses without needing to bypass external defenses.
   • BInsider threats are always malicious, while external attackers are always opportunistic.
   • CExternal attackers always have more technical skill than insiders.
   • DExternal attackers cannot exploit application vulnerabilities if the network firewall is properly configured.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is adding a new feature to its .NET web application that allows users to upload profile pictures and share them with other users. The feature will be publicly accessible. Which action is most important to perform before implementing this feature to reduce the risk of introducing vulnerabilities?

   • ADisable the feature for unauthenticated users to reduce the attack surface.
   • BConduct threat modeling to identify new entry points and potential attack paths introduced by the upload and sharing functionality.
   • CUse a third-party file storage service to ensure the feature is secure.
   • DAdd a CAPTCHA to the upload form to prevent automated attacks.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which scenario best illustrates a security vs. functionality trade-off that can introduce vulnerabilities?

   • ARequiring multi-factor authentication for all users
   • BUsing HTTPS to protect data in transit
   • CEncrypting sensitive data at rest
   • DDisabling password complexity requirements to improve user convenience
   Reveal Solution Discussion Select an answer first