Risk by Domain CCOA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company uses a third-party software vendor for its customer relationship management (CRM) system. The vendor has a history of security incidents. The company is considering whether to continue using the vendor or switch to a different one. The CRM system is deeply integrated into the company's sales processes, and switching would be costly and time-consuming. Which approach BEST manages the supply chain risk in this situation?

   • ATerminate the contract and build an in-house CRM system
   • BSwitch to a different vendor immediately
   • CImplement compensating controls and increase monitoring of the vendor's access
   • DAccept the risk without any additional controls
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's remote workers use personal laptops to access corporate resources. The laptops are not managed by the IT department and do not have endpoint protection installed. Which endpoint risk is MOST directly increased by this practice?

   • ACloud misconfiguration
   • BSupply chain risk
   • CNetwork misconfiguration
   • DMalware exposure
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common source of vulnerabilities in software applications?

   • ARegularly updating the application's dependencies.
   • BInsufficient input validation, allowing malicious data to be processed by the application.
   • CUsing a firewall to filter incoming traffic to the application server.
   • DEncrypting data in transit using TLS.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application allows users to upload profile pictures. The application stores the files on the server and serves them back with the original filename. An attacker uploads a file named 'malicious.php' and then accesses it directly via the URL. Which web application risk is MOST directly exploited?

   • ASecurity misconfiguration
   • BUnrestricted file upload
   • CBroken authentication
   • DInsecure direct object references
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses a public cloud provider for its web application. The application stores user data in a managed database service. The security team is concerned about the risk of another tenant on the same physical hardware accessing their data. Which cloud-specific risk is MOST directly related to this concern?

   • AMulti-tenancy threat
   • BNetwork perimeter weakness
   • CData lifecycle risk
   • DMisconfiguration risk
   Reveal Solution Discussion Select an answer first