ExamTopics Logo
Mail Us[email protected]
Menu
Comptia Discussions
exam questions

Exam CS0-002 All Questions

View all questions & answers for the CS0-002 exam
Go to Exam

Exam CS0-002 topic 1 question 265 discussion

Actual exam question from CompTIA's CS0-002
Question #: 265
Topic #: 1
[All CS0-002 Questions]

During a company’s most recent incident, a vulnerability in custom software was exploited on an externally facing server by an APT. The lessons-learned report noted the following:

• The development team used a new software language that was not supported by the security team's automated assessment tools.
• During the deployment, the security assessment team was unfamiliar with the new language and struggled to evaluate the software during advanced testing. Therefore, the vulnerability was not detected.
• The current IPS did not have effective signatures and policies in place to detect and prevent runtime attacks on the new application.

To allow this new technology to be deployed securely going forward, which of the following will BEST address these findings? (Choose two.)

  • A. Train the security assessment team to evaluate the new language and verify that best practices for secure coding have been followed
  • B. Work with the automated assessment-tool vendor to add support for the new language so these vulnerabilities are discovered automatically
  • C. Contact the human resources department to hire new security team members who are already familiar with the new language
  • D. Run the software on isolated systems so when they are compromised, the attacker cannot pivot to adjacent systems
  • E. Instruct only the development team to document the remediation steps for this vulnerability
  • F. Outsource development and hosting of the applications in the new language to a third-party vendor so the risk is transferred to that provider
Show Suggested Answer Hide Answer
Suggested Answer: AB 🗳️
by CatoFong at Feb. 3, 2023, 4:28 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
AaronS1990
Highly Voted 2 years, 2 months ago
Selected Answer: AB
The fact that examtopics have given us A and C is laughable seeing as they practically contradict eachother
upvoted 6 times
2Fish
2 years, 1 month ago
Agree with AB, this is the best two answers here, and can be deduced from just eliminating the answers that just don't fit.
upvoted 2 times
...
...
gnnggnnggnng
Most Recent 2 years, 2 months ago
Selected Answer: AB
A. Train the security assessment team to evaluate the new language and verify that best practices for secure coding have been followed B. Work with the automated assessment-tool vendor to add support for the new language so these vulnerabilities are discovered automatically The solution will address the findings that the development team used a new software language that was not supported by the security team's automated assessment tools and the security assessment team was unfamiliar with the new language and struggled to evaluate the software during advanced testing. The training of the security assessment team and working with the automated assessment-tool vendor to add support for the new language will ensure that future deployments of the new technology are secure and the vulnerabilities are detected and prevented.
upvoted 2 times
...
CatoFong
2 years, 2 months ago
Selected Answer: AB
"To allow this new technology to be deployed securely going forward" AB only logical answer
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago