WGU University WGU-KEO1 Online Practice Questions and Exam Preparation

WGU University WGU-KEO1 Online Questions & Answers

• Question 1:

  Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component. The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal and environmental metrics. Which rating would CVSS assign this vulnerability?

  A. Critical severity
  B. High severity
  C. Low severity
  D. Medium severity
  B. High severity

  ---

  The Common Vulnerability Scoring System (CVSS) uses the following ranges to determine the severity rating of a vulnerability:

  0.1 - 3.9:.Low severity 4.0 - 6.9:.Medium severity

  7.0 - 8.9:.High severity

  9.0 - 10.0:.Critical severity Since the adjusted score for the vulnerability is 5.9, it falls within the High severity range.

  References: CVSS v3.1 Specification Document - FIRST:.https://www.first.org/cvss/specification-document National Vulnerability Database (NVD) - NIST:.https://nvd.nist.gov/vuln-metrics/cvss

• Question 2:

  During fuzz testing of the new product, an exception was thrown on the order entry view, which caused a full stack dump to be displayed in the browser window that included function names from the source code. How should existing security controls be adjusted to prevent this in the future?

  A. Ensure privileges are restored after application exceptions
  B. Ensure all exceptions are handled in a standardized way
  C. Ensure private information is not logged
  D. Ensure sensitive information is scrubbed from all error messages
  B. Ensure all exceptions are handled in a standardized way

• Question 3:

  Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts. How should existing security controls be adjusted to prevent this in the future?

  A. Ensure passwords are encrypted when stored in persistent data stores
  B. Ensure authentication controls are resistant to brute force attacks
  C. Ensure strong password policies are enforced
  D. Ensure credentials and authentication tokens are encrypted during transit
  B. Ensure authentication controls are resistant to brute force attacks

• Question 4:

  An organization requires developers to attend mandatory security training that covers common vulnerabilities and secure coding standards. Which category of secure software best practices does this represent?

  A. Code review
  B. Architecture analysis
  C. Training
  D. Penetration testing
  C. Training

  ---

  Training is a foundational secure software best practice that ensures developers understand security principles, common vulnerabilities, and organizational policies. Educating developers reduces the likelihood of introducing security flaws during implementation.

• Question 5:

  Senior IT staff has determined that a new product will be hosted in the cloud and will support web and mobile users. Developers will need to deliver secure REST services. Android and IOS mobile apps. and a web application. Developers are currently determining how to deliver each part of the overall product. Which phase of the software development lifecycle (SDLC) is being described?

  A. Maintenance
  B. End of life
  C. Deployment
  D. Design
  D. Design

  ---

  The phase being described is the.Design.phase of the SDLC. During this phase, developers and IT staff determine the architectural and operational details of the product, which includes decisions on how to deliver various components such as secure REST services, mobile apps, and web applications. The Design phase is crucial for setting the foundation for the development work that will follow, ensuring that the product will be secure, scalable, and maintainable. The information aligns with the descriptions of the SDLC phases provided in resources such as GitHub's explanation of the SDLC1.and other industry-standard software development lifecycle resources.

• Question 6:

  The software security team prepared a detailed schedule napping security development lifecycle phases to the type of analysis they will execute. Which design and development deliverable aid the team prepare?

  A. Design security review
  B. Updated threat modeling artifacts
  C. Privacy implementation assessment results
  D. Security test plans
  D. Security test plans

  ---

  The deliverable that would aid a software security team in preparing a detailed schedule mapping security development lifecycle phases to the type of analysis they will execute is.Security test plans. These plans are crucial as they outline the testing strategies and specific security tests that will be conducted during the development lifecycle to ensure the software meets the required security standards. Security test plans.are developed after the requirements and design phases and are used throughout the

  implementation, verification, and release phases. They include detailed instructions for security testing, criteria for success, and the types of security testing to be performed, such as static and dynamic analysis, penetration testing, and code review.

  These plans are living documents that should be updated as new threats are identified and as the project evolves. They ensure that all team members understand the security goals, the risks, and the measures that need to be taken to mitigate those risks.

  By having a well-defined security test plan, the team can ensure that security is not an afterthought but is integrated into every phase of the software development lifecycle, thus producing more secure software. The importance of security test plans in the software development lifecycle is supported by best practices and guidelines from sources such as Microsoft's Security Development Lifecycle1.and Snyk's Secure Software Development Life Cycle principles.

• Question 7:

  Which architecture deliverable identifies the organization's tolerance to security issues and how the organization plans to react if a security issue occurs?

  A. Threat Modeling Artifacts
  B. Risk Mitigation Plan
  C. Business Requirements
  D. Policy Compliance Analysis
  B. Risk Mitigation Plan

• Question 8:

  Which secure coding best practice says to assume all incoming data should be considered untrusted and should be validated to ensure the system only accepts valid data?

  A. General coding practices
  B. Input validation
  C. Session management
  D. System configuration
  B. Input validation

  ---

  The secure coding best practice that emphasizes treating all incoming data as untrusted and subjecting it to validation is known as.input validation. This practice is crucial for ensuring that a system only processes valid, clean data, thereby preventing many types of vulnerabilities, such as SQL injection, cross-site scripting (XSS), and buffer overflows, which can arise from maliciously crafted inputs. Input validation.involves verifying that the data meets certain criteria before it is processed by the system. This

  includes checking for the correct data type, length, format, and range. It also involves sanitizing the data to ensure that it does not contain any potentially harmful elements that could lead to security breaches. A centralized input validation routine is recommended for the entire application, which helps in maintaining consistency and effectiveness in the validation process. This routine should be implemented on a trusted system, typically server-side, to prevent tampering or bypassing of the validation logic.

  It's important to classify all data sources into trusted and untrusted categories and to apply rigorous validation to all data from untrusted sources, such as user input, databases, file streams, and network interfaces.

  By adhering to the input validation best practice, developers can significantly reduce the attack surface of their applications and protect against a wide array of common security threats.

  The verified answer is supported by the Secure Coding Practices outlined by the.OWASP Foundation1.and other reputable sources such as.Coding Dojo2.and.CERT Secure Coding.

• Question 9:

  Which type of security analysis is performed by injecting malformed data into open interfaces of an executable or running application and is most commonly executed during the testing or deployment phases of the SDLC?

  A. Static Analysis
  B. Fuzz Testing
  C. Dynamic Analysis
  D. Manual Code Review
  B. Fuzz Testing

• Question 10:

  A recent vulnerability scan uncovered an XML external entity (XXE) Haw that could allow attackers to return the contents of a system file by including a specific payload in an XML request. How should the organization remediate this vulnerability?

  A. Ensure audit trails exist for all sensitive transactions
  B. Disable resolution of external entities in the parsing library
  C. Enforce role-based authorization in all application layers
  D. Ensure authentication cookies are encrypted
  D. Ensure authentication cookies are encrypted

  ---

  Security change management within the change management process involves ensuring that any changes, including updates or modifications to software, do not introduce new vulnerabilities and are in line with security policies. The question about securing remote administration directly reflects this component because it addresses the security considerations that must be managed when changes are made to how software is accessed and controlled remotely. This includes implementing secure protocols,

  authentication methods, and monitoring to prevent unauthorized access or breaches, which are crucial when managing changes in a secure manner.

  Change management in cybersecurity emphasizes the structured approach to implementing alterations in security protocols, technologies, and processes, ensuring systematic assessment and monitoring.

  The role of change management in cybersecurity includes decisions about network access and ensuring the right person can access the right information at the right time, which aligns with securing remote administration.

  Seminal change management models in cybersecurity, like PROSCI's ADKAR model, guide individuals through the change process, managing resistance and identifying training needs, which is relevant to securing remote administration.