8.3 - Assess the Effectiveness of Software Security CISSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security manager is evaluating the effectiveness of a new security control that was implemented to reduce the risk of data exfiltration from a web application. The control is a data loss prevention (DLP) system that monitors outbound network traffic. After three months, the manager reviews the metrics and finds that the DLP system has blocked 50 potential exfiltration attempts. However, a subsequent penetration test successfully exfiltrated a sample dataset. What is the MOST appropriate conclusion about the control's effectiveness?

   • AThe control is ineffective and should be removed.
   • BThe control is partially effective but has a gap that needs to be addressed.
   • CThe control is effective because it blocked 50 attempts.
   • DThe penetration test was flawed and the results should be ignored.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is developing a new customer-facing web application that will store payment card data. The risk assessment team has identified a critical vulnerability in a third-party library used for input validation. The library is widely used and a patch is not yet available. The team must decide on a mitigation strategy. Which approach is the most appropriate risk mitigation strategy in this situation?

   • AImplement a web application firewall (WAF) rule to block known attack patterns targeting the vulnerability.
   • BRemove the third-party library and rewrite the input validation logic from scratch.
   • CTransfer the risk by purchasing a cybersecurity insurance policy.
   • DAccept the risk and proceed with the launch, documenting the decision.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which activity is MOST directly associated with assessing the effectiveness of a security control?

   • AChecking the uptime of the web server
   • BPenetration testing the application to see if the control can be bypassed
   • CCounting the number of lines of code in the application
   • DReviewing the marketing materials for the security tool
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is reviewing audit logs and notices that a user's account was used to log in from a new location at 2:00 AM. The user then accessed a large number of sensitive documents that they have never accessed before. This activity occurred over a 10-minute period. Which type of security incident does this pattern MOST likely indicate?

   • AA compromised account being used for unauthorized data access.
   • BA brute-force attack on the user's account.
   • CA distributed denial-of-service (DDoS) attack.
   • DA user error, such as accidentally accessing the wrong files.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is investigating a potential data breach. The analyst has access to the following audit logs: web server access logs, database query logs, and authentication logs. The analyst notices that a database query log shows a large number of SELECT statements from a single application user account. The web server logs show a corresponding spike in requests to a specific URL. The authentication logs show no failed login attempts for this account. What is the MOST likely explanation for this activity?

   • AA SQL injection attack is being used to extract data from the database.
   • BA denial-of-service attack is targeting the web server.
   • CThe user is a legitimate administrator performing routine database maintenance.
   • DA brute-force attack is being used to guess the user's password.
   Reveal Solution Discussion Select an answer first