PT0-003 · Question #5
A penetration tester presents the following findings to stakeholders: Control | Number of findings | Risk | Notes Encryption | 1 | Low | Weak algorithm noted Patching | 8 | Medium | Unsupported…
The correct answer is D. Implement an SCA tool. E. Obtain the latest library version. Based on the findings, the focus should be on addressing vulnerabilities in libraries and ensuring Implement an SCA Tool: SCA (Software Composition Analysis) tools are designed to analyze and manage open-source components in an application. Implementing an SCA tool would help…
Question
A penetration tester presents the following findings to stakeholders:
Control | Number of findings | Risk | Notes Encryption | 1 | Low | Weak algorithm noted Patching | 8 | Medium | Unsupported systems System hardening | 2 | Low | Baseline drift observed Secure SDLC | 10 | High | Libraries have vulnerabilities Password policy | 0 | Low | No exceptions noted Based on the findings, which of the following recommendations should the tester make? (Select two).
Options
- ADevelop a secure encryption algorithm.
- BDeploy an asset management system.
- CWrite an SDLC policy.
- DImplement an SCA tool.
- EObtain the latest library version.
- FPatch the libraries.
How the community answered
(42 responses)- A19% (8)
- B5% (2)
- C2% (1)
- D64% (27)
- F10% (4)
Explanation
Based on the findings, the focus should be on addressing vulnerabilities in libraries and ensuring Implement an SCA Tool: SCA (Software Composition Analysis) tools are designed to analyze and manage open-source components in an application. Implementing an SCA tool would help in identifying and managing vulnerabilities in libraries, aligning with the finding of vulnerable libraries in the secure SDLC process. This recommendation addresses the high-risk finding related to the Secure SDLC by providing a systematic approach to manage and mitigate vulnerabilities in software Obtain the Latest Library Version: Keeping libraries up to date is a fundamental practice in maintaining the security of an application. Ensuring that the latest, most secure versions of libraries are used directly addresses the high-risk finding related to vulnerable libraries. This recommendation is a direct and immediate action to mitigate the identified vulnerabilities.
Topics
Community Discussion
No community discussion yet for this question.