WGU University WGU-KEO1 Online Practice Questions and Exam Preparation

WGU University WGU-KEO1 Online Questions & Answers

• Question 21:

  The product security incident response team (PSIRT) has decided to make a formal public disclosure, including base and temporal common vulnerability scoring system (CVSS) scores and a common vulnerabilities and exposures (CVE) ID report, of an externally discovered vulnerability. What is the most likely reason for making a public disclosure?

  A. The potential for increased public awareness of a vulnerability is probable, which could lead to higher risk for customers.
  B. The vulnerability reporter has threatened to make the finding public after being notified that their case was not credible.
  C. The response team has determined that the vulnerability is credible.
  D. Notification of a vulnerability from an external party has occurred.
  C. The response team has determined that the vulnerability is credible.

• Question 22:

  The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations. Which activity of the Ship SDL phase is being performed?

  A. Penetration testing
  B. Policy compliance analysis
  C. Open-source licensing review
  D. Final security review
  A. Penetration testing

  ---

  Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final

  check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.

  The Ship phase of the SDL includes activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensing review, and final security and privacy reviews1.

  Penetration testing is a critical component of the Ship phase, as it helps to identify and fix security vulnerabilities before the software is deployed2.

• Question 23:

  A security tool scans source code to identify insecure function calls without executing the application. Which type of analysis is this?

  A. Dynamic analysis
  B. Fuzz testing
  C. Static analysis
  D. Penetration testing
  C. Static analysis

  ---

  Static analysis examines source code, bytecode, or binaries without running the application. It is used to identify coding flaws, insecure patterns, and potential vulnerabilities early in the SDLC.

• Question 24:

  What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user?

  A. P1 high privacy risk
  B. P2 moderate privacy risk
  C. P3 low privacy risk
  D. P4 no privacy risk
  A. P1 high privacy risk

  ---

  The privacy impact rating for an application that stores personally identifiable information (PII), monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user would be.P1 high privacy risk. Storing PII already poses a significant risk due to the potential for data breaches and misuse. Monitoring users and transferring data, even if anonymous, increases the risk as it involves ongoing data collection. Changing settings without user notification is a serious privacy

  concern because it can lead to unauthorized data processing or sharing, further elevating the risk level.

  References:

  Practical Data Security and Privacy for GDPR and CCPA - ISACA.

  Privacy risk assessment and privacy-preserving data monitoring.

  How To Effectively Monitor Your Privacy Program: A New Series.

• Question 25:

  Which mitigation technique is used to fight against an identity spoofing threat?

  A. Require user authorization
  B. Filtering
  C. Audit trails
  D. Encryption
  A. Require user authorization

  ---

  To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization. This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for

  attackers to spoof an identity successfully.

  Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.

  The National Security Agency's guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures.

  Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks.

  The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud4.

• Question 26:

  An application enforces that users can only access resources explicitly assigned to their role. Which security principle is being implemented?

  A. Defense in depth
  B. Least privilege
  C. Separation of duties
  D. Data classification
  B. Least privilege

  ---

  The principle of least privilege ensures users are granted only the minimum permissions necessary to perform their tasks. Enforcing role-based access limits the impact of compromised accounts and reduces unauthorized access.

• Question 27:

  A software security team recently completed an internal assessment of the company's security assurance program. The team delivered a set of scorecards to leadership along with proposed changes designed to improve low-scoring governance, development, and deployment functions. Which software security maturity model did the team use?

  A. Building Security In Maturity Model (BSIMM)
  B. Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
  C. U.S. Department of Homeland Security Software Assurance Program D. International Organization for Standardization ISO/IEC 27034
  A. Building Security In Maturity Model (BSIMM)

• Question 28:

  Which secure software design principle assumes attackers have the source code and specifications of the product?

  A. Open Design
  B. Psychological Acceptability
  C. Total Mediation
  D. Separation of Privileges
  A. Open Design

• Question 29:

  The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies. Which post-release deliverable is being described?

  A. Security strategy tor MandA products
  B. Security strategy for legacy code
  C. Post-release certifications
  D. External vulnerability disclosure response process
  B. Security strategy for legacy code

  ---

  The task described involves assessing a document management application that has been in use for many years. This scenario typically requires a security strategy that addresses the unique challenges of legacy code. Legacy code refers to software that has been around for a long time and may not have been developed with current security standards in mind.A security strategy for legacy code would include measures to ensure that the application complies with current organizational policies, which may

  involve code reviews, updates, and the implementation of modern security practices to mitigate any potential vulnerabilities inherent in older code.

  References:

  Remotebase, "Best Practices for Managing Legacy Code" Medium, "The Engineer's Complete Guide to Legacy Code" Parasoft, "Testing Legacy Code and 3 Steps to Update"

• Question 30:

  What is a countermeasure to the web application security frame (ASF) authentication threat category?

  A. Role-based access controls restrict access
  B. Credentials and tokens are encrypted.
  C. Cookies have expiration timestamps.
  D. Sensitive information is scrubbed from error messages
  A. Role-based access controls restrict access

  ---

  ASF Authentication Threats:.The Web Application Security Frame (ASF) authentication category encompasses threats related to how users and systems prove their identity to the application. This includes issues like weak passwords, compromised credentials, and inadequate access controls. Role-Based Access Control (RBAC):.RBAC is a well-established security principle that aligns closely with addressing authentication threats. It involves assigning users to roles and granting those roles specific

  permissions based on the principle of least privilege. This limits the attack surface and reduces the impact of a compromised user account.

  Let's analyze the other options:

  B. Credentials and tokens are encrypted:.While vital for security, encryption primarily protects data at rest or in transit. It doesn't directly address authentication risks like brute-force attacks or weak password management.

  C. Cookies have expiration timestamps:.Expiring cookies are a good practice, but their primary benefit is session management rather than directly mitigating authentication-specific threats.

  D. Sensitive information is scrubbed from error messages:.While essential for preventing information leakage, this practice doesn't address the core threats within the ASF authentication category.

  References:

  NIST Special Publication 800-53 Revision 4, Access Control (AC) Family:.(https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final).Details the importance of RBAC as a cornerstone of access control.

  The Web Application Security Frame (ASF):.(https://patents.google.com/patent/US7818788B2/en) Outlines the ASF categories, with authentication being one of the primary areas.