Risk by Domain CCOA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is software provenance in the context of supply chain risk?

   • AThe performance benchmarking of software applications.
   • BThe licensing terms under which software is used.
   • CThe method of distributing software to end users.
   • DThe process of verifying the source and integrity of software components.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial application stores customer transaction history. During a routine audit, the security team finds that the application logs contain full credit card numbers in plaintext, and these logs are accessible to all developers. Which data risk type is MOST directly increased by this practice?

   • AConfidentiality risk
   • BIntegrity risk
   • CSupply chain risk
   • DAvailability risk
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is building a new customer portal. The team frequently copies code snippets from public forums and integrates them into the application without review. Which application risk source is MOST directly introduced by this practice?

   • ABroken authentication
   • BData exposure
   • CNetwork misconfiguration
   • DInsecure code from external sources
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A web application allows users to search for products. The search functionality takes user input and directly includes it in a database query without sanitization. An attacker submits a specially crafted search term that modifies the query to return all user records. Which web application risk is MOST directly exploited?

   • ASQL injection
   • BBroken authentication
   • CInsecure API
   • DSecurity misconfiguration
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a web application risk associated with injection attacks?

   • AAn attacker using social engineering to trick a user into revealing their password.
   • BAn attacker physically stealing a server from the data center.
   • CAn attacker submitting malicious SQL code through a form input to manipulate the database.
   • DAn attacker intercepting network traffic to read unencrypted data.
   Reveal Solution Discussion Select an answer first