Risk by Domain CCOA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization's internal network uses Telnet for remote administration of network devices. A security assessment reveals that an attacker who compromised a single low-privilege workstation can now capture administrative credentials and access core routers. Which combination of risk factors is MOST directly illustrated by this scenario?

   • AData integrity and supply chain dependency
   • BUnsecured protocol and lateral movement
   • CInsecure API and broken authentication
   • DUnpatched software and malware exposure
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company migrates its customer database to a public cloud IaaS environment. The security team discovers that the storage account containing the database is publicly accessible from the internet. Which risk category is MOST directly exemplified by this finding?

   • AData integrity risk due to unauthorized modification of records
   • BNetwork lateral movement risk allowing internal pivoting
   • CCloud misconfiguration risk leading to a confidentiality breach
   • DSupply chain risk from third-party cloud vendor dependency
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A web application has a login form that is vulnerable to brute-force attacks. The security team is considering two controls: implementing account lockout after five failed attempts, and adding CAPTCHA after three failed attempts. The application is used by customers who often forget their passwords. Which control is MOST appropriate to balance security and usability?

   • AImplement CAPTCHA after three failed attempts
   • BImplement account lockout after five failed attempts
   • CImplement both CAPTCHA and account lockout
   • DIncrease password complexity requirements
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software company uses a third-party library for authentication in its flagship product. The library is no longer maintained, and a critical vulnerability is discovered. The company has no direct relationship with the library's original developers. Which risk category is MOST directly relevant to this situation?

   • ANetwork risk
   • BData risk
   • CWeb application risk
   • DSupply chain risk
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a cloud-specific risk associated with multi-tenancy?

   • AThe physical theft of servers from a data center.
   • BA tenant's misconfiguration exposing data to other tenants due to improper isolation.
   • CThe inability to scale resources during peak demand.
   • DThe need to install antivirus software on every virtual machine.
   Reveal Solution Discussion Select an answer first