WGU University WGU-KEO1 Online Practice Questions and Exam Preparation

WGU University WGU-KEO1 Online Questions & Answers

• Question 31:

  The final security review determined that two low-risk security issues identified in testing are still outstanding. Developers have assured the security team that both issues can be resolved quickly once they have time to fix them. The security team is confident that developers can fix the flaws in the first post-release patch. What is the result of the final security review?

  A. Not Passed but Does Not Require Escalation
  B. Not Passed and Requires Escalation
  C. Passed with Exceptions
  D. Passed
  C. Passed with Exceptions

• Question 32:

  The security team contracts with an independent security consulting firm to simulate attacks on deployed products and report results to organizational leadership. Which category of secure software best practices is the team performing?

  A. Attack models
  B. Code review
  C. Architecture analysis
  D. Penetration testing
  D. Penetration testing

  ---

  Engaging an independent security consulting firm to simulate attacks on deployed products is an example of Penetration Testing.

  Penetration testing involves authorized simulated attacks on a system to evaluate its security. The objective is to identify vulnerabilities that could be exploited by malicious entities and to assess the system's resilience against such attacks. This proactive approach helps organizations understand potential weaknesses and implement necessary safeguards.

  According to the OWASP Testing Guide, penetration testing is a critical component of a comprehensive security program:

  "Penetration testing involves testing the security of systems and applications by simulating attacks from malicious individuals."

  References:

  OWASP Testing Guide

• Question 33:

  Which mitigation technique can be used to fight against a denial of service threat?

  A. Digital signatures
  B. Protect secrets
  C. Timestamps
  D. Throttling
  D. Throttling

  ---

  Comprehensive and Detailed From Exact Extract:

  Throttling is a common and effective mitigation technique against Denial of Service (DoS) attacks. It limits the number of requests a user or IP can send over a certain time period, preventing resource exhaustion. This reduces the risk of overwhelming servers, which is the core issue in DoS attacks. Digital signatures (A) protect data integrity and authenticity, Protect secrets (B) secures confidential information, and Timestamps (C) help prevent replay attacks but are not direct defenses for DoS. According to

  NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide) and OWASP DoS Prevention, throttling and rate limiting are standard controls to maintain availability under attack conditions.

  References:

  NIST SP 800-61 Revision 2 ?Computer Security Incident Handling Guide

  OWASP Denial of Service Prevention Cheat Sheet

  Microsoft SDL ?Security Controls for Availability

• Question 34:

  Company leadership has contracted with a security firm to evaluate the vulnerability of all externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?

  A. Properly-based-testing
  B. Source-code analysis
  C. Penetration testing
  D. Source-code fault injection
  C. Penetration testing

  ---

  The security testing technique that involves evaluating the vulnerability of all externally facing enterprise applications through both automated and manual system interactions is known as.Penetration Testing. This method simulates real-world attacks on systems to identify potential vulnerabilities that could be exploited by attackers. It is a proactive approach to discover security weaknesses before they can be exploited in a real attack scenario. Penetration testing can include a variety of methods such as network scanning, application testing, and social engineering tactics to ensure a comprehensive security evaluation. The concept of Penetration Testing as a method for evaluating vulnerabilities aligns with industry standards and practices, as detailed in resources from security-focused organizations and literature1.

• Question 35:

  Which type of manual code review technique is being used when the reviewer starts at an input control and traces its value through the application to each of the value's outputs?

  A. Risk analysis
  B. Control flow analysis
  C. Data flow analysis
  D. Threat analysis
  C. Data flow analysis

  ---

  Data flow analysis is a manual code review technique where the reviewer traces the path of data from its entry point in the software (input control) through its processing and manipulation within the application, to its exit points (outputs).This technique is used to ensure that the data is handled securely throughout its lifecycle within the application and to identify any potential security vulnerabilities that may arise from improper data handling or processing

• Question 36:

  What is the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or distribution to provide confidentiality, integrity, and availability?

  A. Availability
  B. Integrity
  C. Confidentiality
  D. Information Security
  D. Information Security

• Question 37:

  After being notified of a vulnerability in the company's online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab. What is the response team's next step?

  A. Determine the Severity of the Vulnerability
  B. Notify the Reporter That the Case Is Going to Be Closed
  C. Determine How the Reporter Was Able to Create the Vulnerability
  D. Identify Resources and Schedule the Fix
  C. Determine How the Reporter Was Able to Create the Vulnerability

• Question 38:

  The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives. Which BSIMM domain is being assessed?

  A. Governance
  B. Software security development life cycle (SSDL) touchpoints
  C. Intelligence
  D. Deployment
  C. Intelligence

  ---

  The.Intelligence.domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization's ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain. The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework.

• Question 39:

  Which threat modeling step identifies the assets that need to be protected?

  A. Set the Scope
  B. Analyze the Target
  C. Rate Threats
  D. Identify and Document Threats
  A. Set the Scope

• Question 40:

  A tester evaluates an application solely through its user interface by providing various input combinations and examining outputs. Which testing method is being used?

  A. White box testing
  B. Static testing
  C. Black box testing
  D. Source code analysis
  C. Black box testing

  ---

  Black box testing evaluates an application from the user's perspective without knowledge of internal implementation. The tester focuses on inputs and outputs to verify correct behavior and identify potential security or functional issues.