WGU University WGU-KEO1 Online Practice Questions and Exam Preparation

WGU University WGU-KEO1 Online Questions & Answers

• Question 41:

  Which threat modeling methodology involves creating or using collections of similar threats?

  A. Data Flow Diagrams
  B. Attack Libraries
  C. Attack Trees
  D. Security Profile
  B. Attack Libraries

• Question 42:

  Which DKEAD category has a risk rating based on the threat exploit's potential level of harm?

  A. Damage potential
  B. Reproducibility
  C. Affected users
  D. Exploitability
  A. Damage potential

  ---

  The DKEAD category that has a risk rating based on the threat exploit's potential level of harm is.Damage potential. This category assesses the total damage or impact that a threat could cause if it is exploited by an attacker. The risk rating in this category is determined by evaluating the severity of the potential damage, which could range from information disclosure to complete system destruction or loss of system availability. : DREAD Threat Modeling1 OWASP Risk Rating Methodology2 DREAD Threat Modeling: An Introduction to Qualitative Risk Analysis

• Question 43:

  The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure. Which security testing technique is being used?

  A. Source-Code Fault Injection
  B. Dynamic Code Analysis
  C. Fuzz Testing
  D. Binary Fault Injection
  A. Source-Code Fault Injection

• Question 44:

  The software security team is performing security testing on a new software product using a testing tool that scans the running application for known exploit signatures. Which security testing technique is being used?

  A. Automated vulnerability scanning
  B. Penetration testing
  C. Properly-based testing
  D. Source-code analysis
  A. Automated vulnerability scanning

  ---

  The security testing technique that involves using a testing tool to scan a running application for known exploit signatures is known as.Automated Vulnerability Scanning. This method is part of dynamic analysis, which assesses the software in its running state to identify vulnerabilities that could be exploited by attackers.Automated vulnerability scanning tools are designed to detect and report known vulnerabilities by comparing the behavior and outputs of the application against a database of known exploit signatures.

  References: Application Security Testing: Tools, Types and Best Practices | GitHub

• Question 45:

  Which software-testing technique can be automated or semi-automated and provides invalid, unexpected, or random data to the inputs of a computer software program?

  A. Fuzzing
  B. Static analysis
  C. Dynamic analysis
  D. Bugtraq
  A. Fuzzing

  ---

  Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs.Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols.

  References:

  1: Wikipedia - Fuzzing.

  2: DZone - Fuzzing in Software Engineering

• Question 46:

  A recent security review has identified an aging credential recovery/forgotten password component that emails temporary passwords to users who claim to have forgotten their application password. How should the organization remediate this vulnerability?

  A. Lock a User Account After Multiple Failed Authentication Attempts
  B. Ensure All Authorization Requests Are Logged
  C. Implement Multifactor Authentication
  D. Implement Role-Based Authorization
  C. Implement Multifactor Authentication

• Question 47:

  The security team is reviewing whether changes or open issues exist that would affect requirements for handling personal information documented in earlier phases of the development life cycle. Which activity of the Ship SDL phase is being performed?

  A. Vulnerability scan
  B. Final security review
  C. Open-source licensing review
  D. Final privacy review
  D. Final privacy review

  ---

  The activity being performed is the final privacy review. This step is crucial in the Ship phase of the Security Development Lifecycle (SDL), where the security team assesses if there are any changes or unresolved issues that could impact the requirements for handling personal information. These requirements are typically documented in the earlier stages of the development lifecycle, and the final privacy review ensures that the software complies with these requirements before release. The explanation is based on the best practices outlined in the SDL Activities and Best Practices, which detail the importance of conducting a final privacy review during the Ship phase to ensure that all privacy issues have been addressed.

• Question 48:

  Which security assessment deliverable identifies possible security vulnerabilities in the product?

  A. Threat profile
  B. Metrics template
  C. SDL project outline
  D. List of third-party software
  A. Threat profile

  ---

  Comprehensive and Detailed From Exact Extract:

  A Threat profile is a security assessment deliverable that outlines and identifies possible security vulnerabilities and threats relevant to a product. It includes categorization of threats, their potential impact, and vectors through which the product can be attacked. This deliverable is crucial for guiding mitigation and security testing efforts. Metrics templates (B) track progress or measurements, SDL project outline (C) documents phases and tasks in the secure development lifecycle, and the list of third-party

  software (D) catalogs external dependencies but does not specifically identify vulnerabilities. As per Microsoft SDL and OWASP Threat Modeling, the threat profile is a foundational deliverable in risk assessment and vulnerability identification.

  References:

  Microsoft Security Development Lifecycle (SDL) Documentation OWASP Threat Modeling Guide NIST SP 800-154: Guide to Data-Centric System Threat Modeling

• Question 49:

  A security team is reviewing open-source libraries used by a product to ensure license terms are followed. Which SDL Ship phase activity is being performed?

  A. Final security review
  B. Penetration testing
  C. Open-source licensing review
  D. Policy compliance analysis
  C. Open-source licensing review

  ---

  An open-source licensing review verifies that third-party components comply with legal and licensing requirements. This activity is commonly performed during the Ship phase to reduce legal and operational risk before release.

• Question 50:

  The Chief Information Security Officer (CISO) has recommended contracting with external experts to perform annual reviews of the enterprise's software products, including penetration testing. Which post-release deliverable is being described?

  A. Security Strategy for Legacy Code
  B. Post-Release Certifications
  C. Third-Party Security Review
  D. External Vulnerability Disclosure Response Process
  C. Third-Party Security Review