WGU University WGU-KEO1 Online Practice Questions and Exam Preparation

WGU University WGU-KEO1 Online Questions & Answers

• Question 11:

  Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized?

  A. Authentication and Password Management
  B. Input Validation
  C. System Configuration
  D. Error Handling and Logging
  D. Error Handling and Logging

• Question 12:

  During fuzz testing of the new product, random values were entered into input elements Search requests were sent to the correct API endpoint but many of them failed on execution due to type mismatches. How should existing security controls be adjusted to prevent this in the future?

  A. Ensure all user input data is validated prior to transmitting requests
  B. Ensure all requests and responses are encrypted
  C. Ensure sensitive transactions can be traced through an audit log
  D. Ensure the contents of authentication cookies are encrypted
  A. Ensure all user input data is validated prior to transmitting requests

  ---

  Validating user input data before it is processed by the application is a fundamental security control in software design. This process, known as input validation, ensures that only properly formed data is entering the workflow of the application, thereby preventing many types of attacks, including type mismatches as mentioned in the question. By validating input data, the application can reject any requests that contain unexpected or malicious data, reducing the risk of security vulnerabilities and ensuring the

  integrity of the system.

  Secure SDLC practices emphasize the importance of integrating security activities, such as creating security and functional requirements, code reviews, security testing, architectural analysis, and risk assessment, into the existing development workflow1.

  A Secure Software Development Life Cycle (SSDLC) ensures that security is considered at every phase of the development process, from planning and design to coding, testing, deploying, and maintaining the software.

• Question 13:

  Credit card numbers are encrypted when stored in the database but are automatically decrypted when data is fetched. The testing tool intercepted the GET response, and testers were able to view credit card numbers as clear text. How should the organization remediate this vulnerability?

  A. Never cache sensitive data
  B. Ensure there is an audit trail for all sensitive transactions
  C. Ensure all data in transit is encrypted
  D. Enforce role-based authorization controls in all application layers
  C. Ensure all data in transit is encrypted

  ---

  The core issue here is cleartext transmission of sensitive data, and option C directly addresses this:

  Addressing the Problem:.The scenario reveals the vulnerability is the lack of encryption during data transmission (the GET response). Ensuring encryption in transit fixes this specific exploit.

  Transport Layer Security:.Encryption during transit is typically achieved through protocols like TLS (HTTPS), preventing the interception of sensitive information.

• Question 14:

  Which threat modeling step assigns a score to discovered threats?

  A. Rate Threats
  B. Analyze the Target
  C. Identify and Document Threats
  D. Set the Scope
  A. Rate Threats

• Question 15:

  Security testers have completed testing and are documenting the results of vulnerability scans and penetration analysis They are also creating documentation lo share with the organization's largest customers. Which deliverable is being prepared?

  A. Open-source licensing review report
  B. Customer engagement framework
  C. Remediation report
  D. Security testing reports
  D. Security testing reports

  ---

  After completing vulnerability scans and penetration analysis, security testers document the results to share with stakeholders, such as the organization's largest customers. The deliverable being prepared in this context is the.Security testing reports. These reports typically include detailed findings from the security assessments, explanations of the vulnerabilities discovered, the potential risks they pose, and recommendations for remediation.The purpose of these reports is to provide transparency about the

  security posture of the software or system and to guide the organization in addressing the identified security issues.

  References:

  https://blog.halosecurity.com/what-really-matters-when-it-comes-to-pentesting-deliverables/

• Question 16:

  The security team has a library of recorded presentations that are required viewing tor all new developers in the organization. The video series details organizational security policies and demonstrates how to define, test for. and code tor possible threats. Which category of secure software best practices does this represent?

  A. Attack models
  B. Training
  C. Architecture analysis
  D. Code review
  B. Training

  ---

  The category of secure software best practices being described is.Training. This is because the focus is on educating new developers about organizational security policies and coding practices to mitigate potential threats. Training is a proactive approach to ensure that developers are aware of security concerns and are equipped with the knowledge to address them in their coding practices. The importance of training in secure software best practices is supported by industry resources such as the SAFECode's "Fundamental Practices for Secure Software Development" which emphasizes the need for application security control definition and management1, and the NIST's Secure Software Development Framework (SSDF) which recommends integrating secure development practices throughout the software development lifecycle2.Additional support for this category can be found in resources detailing effective secure development practices.

• Question 17:

  Which step in the change management process includes modifying the source code?

  A. Patch management
  B. Installation management
  C. Privacy implementation assessment
  D. Policy compliance analysis
  A. Patch management

  ---

  Modifying the source code is typically associated with the patch management step in the change management process. Patch management involves the acquisition, testing, and installation of code changes, which can include updates, bug fixes, or improvements to existing software. This step ensures that modifications to the software are made in a controlled and systematic manner, maintaining the integrity and security of the software throughout the change.

  References: The information provided aligns with industry-standard practices for change management in software engineering.

• Question 18:

  The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one-time requirements, bucket requirements, and final security review requirements. Which type of requirement slates that the team must identify primary security and privacy contacts?

  A. Final security review requirement
  B. Bucket requirement
  C. Every-sprint requirement
  D. One-time requirement
  B. Bucket requirement

  ---

  Bucket requirements are ongoing requirements that do not need to be addressed every sprint but must be completed before project completion. Identifying primary security and privacy contacts is a bucket requirement because it is a one-time, essential task that supports security governance throughout the project lifecycle. Every-sprint requirements (D) are repeated tasks for each sprint, one-time requirements (C) are tasks performed once usually early in the project, and final security review (B) occurs at

  project end. Agile SDL adaptation recommendations by Microsoft SDL and OWASP emphasize categorizing security tasks to fit iterative delivery, with bucket requirements ensuring important but non-iterative activities are not overlooked.

  References:

  Microsoft SDL Agile Adaptation Guidelines OWASP Secure SDLC in Agile NIST SP 800-64: Security Considerations in Agile Development

• Question 19:

  Developers have finished coding, and changes have been peer-reviewed. Features have been deployed to a pre-production environment so that analysts may verify that the product is working as expected. Which phase of the Software Development Life Cycle (SDLC) is being described?

  A. Requirements
  B. Design
  C. Testing
  D. Deployment
  C. Testing

  ---

  The scenario describes a stage where the developed features are deployed to a pre-production environment for verification by analysts. This aligns with the Testing phase of the Software Development Life Cycle (SDLC).

  In the Testing phase, the system undergoes various evaluations to ensure it meets the specified requirements and functions correctly. This includes deploying the software in an environment that simulates production to identify and rectify defects before the actual deployment. The primary goal is to validate the software's quality and performance. According to the SDLC framework, after the development (coding) phase, the next step is Testing, where the system is rigorously evaluated. This phase is crucial to

  detect issues that may not have been apparent during development and to ensure that the software operates as intended in a controlled setting before live deployment.

  References:

  Software Development Life Cycle Documentation

• Question 20:

  A legacy application has been replaced by a new product that provides mobile capabilities to the company's customer base. The two products have run concurrently for the last three months to provide a fallback if the new product experienced a large-scale failure. The time has come to turn off access to the legacy application. Which phase of the Software Development Life Cycle (SDLC) is being described?

  A. End of Life
  B. Design
  C. Maintenance
  D. Planning
  A. End of Life

  ---

  The scenario outlines the process of decommissioning a legacy application after a new product has successfully taken over its functions. This corresponds to the End of Life phase in the Software Development Life Cycle (SDLC).

  The End of Life phase involves retiring outdated systems and transitioning users to newer solutions. This phase ensures that obsolete applications are systematically phased out, reducing maintenance costs and potential security vulnerabilities associated with unsupported software.

  In this case, running both the legacy and new applications concurrently provided a safety net to ensure the new system's stability. After confirming the new product's reliability, the organization proceeds to disable the legacy system, marking its End of Life.

  References:

  Systems Development Life Cycle