CAS-004 Exam Dumps | During a software assurance assessment, an engineer notices the source code contains multiple instances

<< Prev Question Next Question >>

Question 54/204

During a software assurance assessment, an engineer notices the source code contains multiple instances of strcpy. which does not verify the buffer length. Which of the following solutions should be integrated into the SDLC process to reduce future risks?

A. Require custom IDS/IPS detection signatures for each type of insecure function found.

B. Perform a penetration test before moving to the next step of the SDLC.

C. Update the company's secure coding policy to exclude insecure functions.

D. Perform DAST/SAST scanning before handoff to another team.

Question List (204q): Question 1: A company recently acquired a SaaS provider and needs to int...; Question 2: An organization performed a risk assessment and discovered t...; Question 3: A small bank is evaluating different methods to address and ...; Question 4: A security architect needs to implement a CASB solution for ...; Question 5: Which of the following describes the system responsible for ...; Question 6: A company just released a new video card. Due to limited sup...; Question 7: A company wants to refactor a monolithic application to take...; Question 8: A cyberanalyst for a government agency is concerned about ho...; Question 9: A cloud security engineer is setting up a cloud-hosted WAF. ...; Question 10: A university issues badges through a homegrown identity mana...; Question 11: A small business requires a low-cost approach to theft detec...; Question 12: Ransomware encrypted the entire human resources fileshare fo...; Question 13: A company is repeatedly being breached by hackers who valid ...; Question 14: During a system penetration test, a security engineer succes...; Question 15: A satellite communications ISP frequently experiences outage...; Question 16: A company was recently infected by malware. During the root ...; Question 17: Clients are reporting slowness when attempting to access a s...; Question 18: An organization is researching the automation capabilities f...; Question 19: A Chief Information Security Officer is concerned about the ...; Question 20: A security administrator is setting up a virtualization solu...; Question 21: A company created an external application for its customers....; Question 22: A Chief Security Officer (CSO) is concerned about the number...; Question 23: A security manager has written an incident response playbook...; Question 24: Which of the following represents the MOST significant benef...; Question 25: A DNS forward lookup zone named complia.org must: * Ensure t...; Question 26: A company created an external, PHP-based web application for...; Question 27: An organization has deployed a cloud-based application that ...; Question 28: A Chief Information Officer (CIO) wants to implement a cloud...; Question 29: Law enforcement officials informed an organization that an i...; Question 30: Which of the following is a risk associated with SDN?...; Question 31: A security engineer is assessing a legacy server and needs t...; Question 32: A company uses a CSP to provide a front end for its new paym...; Question 33: During the development process, the team identifies major co...; Question 34: An enterprise is deploying APIs that utilize a private key a...; Question 35: Users are claiming that a web server is not accessible. A se...; Question 36: A security architect is reviewing the following organization...; Question 37: A company hired a third party to develop software as part of...; Question 38: The Chief Information Security Officer (CISO) asked a securi...; Question 39: A company is migrating from company-owned phones to a BYOD s...; Question 40: An organization decided to begin issuing corporate mobile de...; Question 41: Which of the following BEST sets expectation between the sec...; Question 42: An organization's hunt team thinks a persistent threats exis...; Question 43: A software development company wants to ensure that users ca...; Question 44: An organization does not have visibility into when company-o...; Question 45: An organization recently experienced a ransomware attack. Th...; Question 46: A security engineer is working for a service provider and an...; Question 47: A company wants to quantify and communicate the effectivenes...; Question 48: A health company has reached the physical and computing capa...; Question 49: A company's Chief Information Officer wants to Implement IDS...; Question 50: A networking team was asked to provide secure remote access ...; Question 51: A home automation company just purchased and installed tools...; Question 52: A security officer is requiring all personnel working on a s...; Question 53: A security engineer needs to select the architecture for a c...; Question 54: During a software assurance assessment, an engineer notices ...; Question 55: A security team received a regulatory notice asking for info...; Question 56: An organization is considering a BYOD standard to support re...; Question 57: A security analyst discovered that a database administrator'...; Question 58: A senior security analyst is helping the development team im...; Question 59: A developer wants to develop a secure external-facing web ap...; Question 60: A customer reports being unable to connect to a website at w...; Question 61: A company that all mobile devices be encrypted, commensurate...; Question 62: Company A is merging with Company B Company A is a small, lo...; Question 63: Given the following log snippet from a web server: (Exhibit)...; Question 64: An application security engineer is performing a vulnerabili...; Question 65: A forensics investigator is analyzing an executable file ext...; Question 66: The information security manager at a 24-hour manufacturing ...; Question 67: Due to internal resource constraints, the management team ha...; Question 68: A security analyst discovered that the company's WAF was not...; Question 69: A mobile administrator is reviewing the following mobile dev...; Question 70: An multinational organization was hacked, and the incident r...; Question 71: A company has decided to purchase a license for software tha...; Question 72: A security analyst is participating in a risk assessment and...; Question 73: A cybersecurity analyst receives a ticket that indicates a p...; Question 74: A security consultant is designing an infrastructure securit...; Question 75: Due to budget constraints, an organization created a policy ...; Question 76: A Chief Information Officer is considering migrating all com...; Question 77: Company A acquired Company B. During an audit, a security en...; Question 78: A local university that has a global footprint is undertakin...; Question 79: A company is looking to fortify its cybersecurity defenses a...; Question 80: Based on a recent security audit, a company discovered the p...; Question 81: A Chief information Security Officer (CISO) is developing co...; Question 82: Device event logs sources from MDM software as follows: (Exh...; Question 83: An internal security assessor identified large gaps in a com...; Question 84: A business stores personal client data of individuals residi...; Question 85: A recent security assessment generated a recommendation to t...; Question 86: An e-commerce company is running a web server on premises, a...; Question 87: A financial institution generates a list of newly created ac...; Question 88: A systems administrator at a web-hosting provider has been t...; Question 89: An ISP is receiving reports from a portion of its customers ...; Question 90: To save time, a company that is developing a new VPN solutio...; Question 91: Users are reporting intermittent access issues with a new cl...; Question 92: A company has moved its sensitive workloads lo the cloud and...; Question 93: A Chief information Security Officer (CISO) has launched to ...; Question 94: A small business would like to provide guests who are using ...; Question 95: A security engineer is trying to identify instances of a vul...; Question 96: A security consultant has been asked to identify a simple, s...; Question 97: SIMULATION A product development team has submitted code sni...; Question 98: In order to save money, a company has moved its data to the ...; Question 99: A large telecommunications equipment manufacturer needs to e...; Question 100: A security analyst has been tasked with assessing a new API ...; Question 101: The Chief information Officer (CIO) of a large bank, which u...; Question 102: A security administrator configured the account policies per...; Question 103: The Chief information Officer (CIO) asks the system administ...; Question 104: A company based in the United States holds insurance details...; Question 105: A vulnerability scanner detected an obsolete version of an o...; Question 106: An organization is preparing to migrate its production envir...; Question 107: A developer needs to implement PKI in an autonomous vehicle'...; Question 108: A shipping company that is trying to eliminate entire classe...; Question 109: After the latest risk assessment, the Chief Information Secu...; Question 110: Which of the following agreements includes no penalties and ...; Question 111: A security consultant needs to set up wireless security for ...; Question 112: Which of the following is the MOST important security object...; Question 113: An organization recently started processing, transmitting, a...; Question 114: A security engineer notices the company website allows users...; Question 115: A security analyst is trying to identify the source of a rec...; Question 116: Which of the following is a security concern for DNP3?...; Question 117: A software developer created an application for a large, mul...; Question 118: An organization is prioritizing efforts to remediate or miti...; Question 119: A security analyst identified a vulnerable and deprecated ru...; Question 120: A company is deploying multiple VPNs to support supplier con...; Question 121: An organization requires a legacy system to incorporate refe...; Question 122: An organization's assessment of a third-party, non-critical ...; Question 123: A company is experiencing a large number of attempted networ...; Question 124: Which of the following BEST describes a common use case for ...; Question 125: A security engineer is creating a single CSR for the followi...; Question 126: A security architect is reviewing the following proposed cor...; Question 127: Company A is establishing a contractual with Company B. The ...; Question 128: A security analyst is researching containerization concepts ...; Question 129: A security manager wants to transition the organization to a...; Question 130: A software company is developing an application in which dat...; Question 131: A company with customers in the United States and Europe wan...; Question 132: A security analyst is reviewing the following output: (Exhib...; Question 133: A bank hired a security architect to improve its security me...; Question 134: An attacker infiltrated an electricity-generation site and d...; Question 135: An organization is looking to establish more robust security...; Question 136: An organization's finance system was recently attacked. A fo...; Question 137: During a recent security incident investigation, a security ...; Question 138: An investigator is attempting to determine if recent data br...; Question 139: A forensic expert working on a fraud investigation for a US-...; Question 140: A security analyst notices a number of SIEM events that show...; Question 141: A pharmaceutical company uses a cloud provider to host thous...; Question 142: A security auditor needs to review the manner in which an en...; Question 143: A security architect is implementing a web application that ...; Question 144: A security analyst receives an alert from the SIEM regarding...; Question 145: A forensic investigator would use the foremost command for:...; Question 146: A network administrator for a completely air-gapped and clos...; Question 147: A software house is developing a new application. The applic...; Question 148: A security engineer has been asked to close all non-secure c...; Question 149: A web service provider has just taken on a very large contra...; Question 150: Technicians have determined that the current server hardware...; Question 151: A cybersecurity analyst discovered a private key that could ...; Question 152: A new web server must comply with new secure-by-design princ...; Question 153: An auditor needs to scan documents at rest for sensitive tex...; Question 154: A security analyst has been provided the following partial S...; Question 155: An analyst has prepared several possible solutions to a succ...; Question 156: in a situation where the cost of anti-malware exceeds the po...; Question 157: A company launched a new service and created a landing page ...; Question 158: Which of the following protocols is a low power, low data ra...; Question 159: A security analyst wants to keep track of alt outbound web c...; Question 160: A consultant needs access to a customer's cloud environment....; Question 161: A security engineer was auditing an organization's current s...; Question 162: A security architect is tasked with securing a new cloud-bas...; Question 163: A user experiences an HTTPS connection error when trying to ...; Question 164: A company wants to improve Its active protection capabilitie...; Question 165: Which of the following describes how a risk assessment is pe...; Question 166: The Chief Information Security Officer of a startup company ...; Question 167: A systems administrator is in the process of hardening the h...; Question 168: A recent data breach revealed that a company has a number of...; Question 169: Which of the following objectives BEST supports leveraging t...; Question 170: The Chief information Officer (CIO) wants to establish a non...; Question 171: An organization is implementing a new identity and access ma...; Question 172: An organization is establishing a new software assurance pro...; Question 173: A security engineer at a company is designing a system to mi...; Question 174: A company suspects a web server may have been infiltrated by...; Question 175: An organization is assessing the security posture of a new S...; Question 176: A security engineer is hardening a company's multihomed SFTP...; Question 177: The principal security analyst for a global manufacturer is ...; Question 178: A company undergoing digital transformation is reviewing the...; Question 179: A company's Chief Information Security Officer wants to prev...; Question 180: A systems engineer needs to develop a solution that uses dig...; Question 181: Which of the following security features do email signatures...; Question 182: A company recently deployed a SIEM and began importing logs ...; Question 183: (Exhibit); Question 184: An analyst determined that the current process for manually ...; Question 185: A security engineer has learned that terminated employees' a...; Question 186: A managed security provider (MSP) is engaging with a custome...; Question 187: Which of the following processes involves searching and coll...; Question 188: A company wants to implement a new website that will be acce...; Question 189: A Chief Information Security Officer (CISO) received a call ...; Question 190: A company with multiple locations has taken a cloud-only app...; Question 191: The Chief Executive Officer of an online retailer notices a ...; Question 192: The general counsel at an organization has received written ...; Question 193: A company publishes several APIs for customers and is requir...; Question 194: A company in the financial sector receives a substantial num...; Question 195: A security architect works for a manufacturing organization ...; Question 196: To bring digital evidence in a court of law the evidence mus...; Question 197: A company is implementing SSL inspection. During the next si...; Question 198: Ann, a CIRT member, is conducting incident response activiti...; Question 199: The CI/CD pipeline requires code to have close to zero defec...; Question 200: A company provides guest WiFi access to the internet and phy...; Question 201: A security review of the architecture for an application mig...; Question 202: A company would like to move its payment card data to a clou...; Question 203: After a security incident, a network security engineer disco...; Question 204: Company A acquired Company B. During an initial assessment, ...

Question 54/204

LEAVE A REPLY

Download PDF File