bhuttomustafa1227

NEED URGENT support

A high-severity vulnerability was found on a web application and introduced to the enterprise. The vulnerability could allow an unauthorized user to utilize an open-source library to view privileged user information. The enterprise is unwilling to accept the risk, but the developers cannot fix the issue right away.

Which of the following should be implemented to reduce the risk to an acceptable level until the issue can be fixed?

Options:

A Scan the code with a static code analyzer, change privileged user passwords, and provide security training.
B Change privileged usernames, review the OS logs, and deploy hardware tokens.
C Implement MFA, review the application logs, and deploy a WAF.
D Deploy a VPN, configure an official open-source library repository, and perform a full application review for vulnerabilities.

A home automation company just purchased and installed tools for its SOC to enable incident identification and response on software the company develops. The company would like to prioritize defenses against the following attack scenarios:

✑ Unauthorized insertions into application development environments

✑ Authorized insiders making unauthorized changes to environment configurations

Which of the following actions will enable the data feeds needed to detect these types of attacks on development environments? (Choose two.)

1. Perform static code analysis of committed code and generate summary reports.
2. Implement an XML gateway and monitor for policy violations.
3. Monitor dependency management tools and report on susceptible third-party libraries.
4. Install an IDS on the development subnet and passively monitor for vulnerable services.
5. Model user behavior and monitor for deviations from normal.
6. Continuously monitor code commits to repositories and generate summary logs.

During a remodel, a company's computer equipment was moved to a secure storage room with cameras positioned on both sides of the door. The door is locked using a card reader issued by the security team, and only the security team and department managers have access to the room. The company wants to be able to identify any unauthorized individuals who enter the storage room by following an authorized employee.

Which of the following processes would BEST satisfy this requirement?

Options: A Monitor camera footage corresponding to a valid access request.
B Require both security and management to open the door.
C Require department managers to review denied-access requests.
D Issue new entry badges on a weekly basis.

A recent data breach revealed that a company has a number of files containing customer data across its storage environment. These files are individualized for each employee and are used in tracking various customer orders, inquiries, and issues. The files are not encrypted and can be accessed by anyone. The senior management team would like to address these issues without interrupting existing processes.

Which of the following should a security architect recommend?

1. A DLP program to identify which files have customer data and delete them
2. An ERP program to identify which processes need to be tracked
3. A CMDB to report on systems that are not configured to security baselines
4. A CRM application to consolidate the data and provision access based on the process and need