CAS-003 · Question #24
A software development team is conducting functional and user acceptance testing of internally developed web applications using a COTS solution. For automated testing, the solution uses valid user…
The correct answer is A. Restrict access to the network share by adding a group only for developers to the share's ACL B. Implement a new COTS solution that does not use hard-coded credentials and integrates with. The scenario presents two critical problems: (1) credentials are stored on a share accessible to everyone on the network, and (2) the credentials belong to the team lead's personal account, meaning compromise affects a real privileged user. Option A addresses the first problem…
Question
A software development team is conducting functional and user acceptance testing of internally developed web applications using a COTS solution. For automated testing, the solution uses valid user credentials from the enterprise directory to authenticate to each application. The solution stores the username in plain text and the corresponding password as an encoded string in a script within a file, located on a globally accessible network share. The account credentials used belong to the development team lead. To reduce the risks associated with this scenario while minimizing disruption to ongoing testing, which of the following are the BEST actions to take? (Choose two.)
Options
- ARestrict access to the network share by adding a group only for developers to the share's ACL
- BImplement a new COTS solution that does not use hard-coded credentials and integrates with
- CObfuscate the username within the script file with encoding to prevent easy identification and the
- DProvision a new user account within the enterprise directory and enable its use for authentication
- ERedesign the web applications to accept single-use, local account credentials for authentication
How the community answered
(39 responses)- A64% (25)
- C5% (2)
- D18% (7)
- E13% (5)
Explanation
The scenario presents two critical problems: (1) credentials are stored on a share accessible to everyone on the network, and (2) the credentials belong to the team lead's personal account, meaning compromise affects a real privileged user. Option A addresses the first problem immediately and with minimal disruption - restricting the share's ACL to a developers-only group means only authorized team members can access the script file. Option D addresses the second problem - provisioning a dedicated service account for testing purposes means that if credentials are ever exposed, only that isolated account is affected rather than the team lead's account with potentially broader permissions. Option C (obfuscation) provides no real security; encoding is trivially reversible. Option E (redesigning the web applications) would be highly disruptive to ongoing testing. Option B (replacing the COTS solution) is a valid long-term fix but would cause significant disruption to active testing. The key constraint is 'minimizing disruption to ongoing testing,' which makes A and D the most practical and immediately actionable pair.
Topics
Community Discussion
No community discussion yet for this question.