D340 Cyber Defense and Countermeasures - Set 5 - Part 2

Correct Answer: The amount and type of risk an organization is willing to accept

Risk appetite expresses how much risk leadership is prepared to accept in pursuit of objectives, guiding which risks require treatment and which may be accepted.

Correct Answer: A business owner with authority over the affected function

Risk acceptance is a business decision requiring someone with authority and accountability for the affected function, not a technical staff decision.

Correct Answer: Evaluating whether controls are implemented correctly and operating effectively

Control assessment verifies that controls exist as documented and function as intended, distinguishing intended security from actual security.

Correct Answer: It avoids the blind spots and bias of those who built the controls

Those who designed and operate a system share its assumptions. Independent assessors bring fresh perspective and are not invested in a favorable outcome.

Correct Answer: Evaluating whether a design adequately addresses relevant threats before build

Architecture review identifies design-level security weaknesses early, when correcting them is far cheaper than after implementation and deployment.

Correct Answer: Embedding security activities into each development phase

A secure SDLC integrates threat modeling, secure coding, code review, and testing throughout development rather than treating security as a final gate.

Correct Answer: Analyzing source code for vulnerabilities without executing it

SAST examines source code or binaries for vulnerable patterns without running the program, finding issues early but producing some false positives.

Correct Answer: Testing a running application by sending inputs and observing responses

DAST probes a running application from the outside, finding runtime and configuration issues that static analysis of code alone cannot detect.

Correct Answer: They detect different classes of vulnerabilities at different stages

SAST finds code-level flaws early with full code visibility, while DAST finds runtime and environment issues in the deployed application, covering different gaps.

Correct Answer: Identifying vulnerabilities and licenses in third-party dependencies

SCA inventories open-source and third-party components, flagging known vulnerabilities and license obligations that the application inherits.

Correct Answer: Most application code today comes from third-party components

Applications typically consist largely of third-party code, so their vulnerabilities become yours, requiring active inventory, monitoring, and updating.

Correct Answer: Securely storing and controlling access to credentials, keys, and tokens

Secrets managers centralize storage of credentials and keys with access control, auditing, and rotation, replacing secrets scattered in code and configuration files.

Correct Answer: Repository history retains them even after removal, and access is often broad

Committed secrets persist in version history and may be exposed to everyone with repository access or through accidental publication, requiring rotation not just deletion.

Correct Answer: Securing images, registries, runtime configuration, and orchestration

Container security addresses vulnerabilities in images, integrity of registries, runtime privileges and isolation, and secure orchestration configuration.

Correct Answer: Base images and dependencies frequently contain known vulnerabilities

Images inherit vulnerabilities from base layers and packages, so scanning before deployment prevents knowingly shipping exploitable components to production.

Correct Answer: A container escape or compromise would gain elevated host privileges

Running as an unprivileged user limits what an attacker achieves after compromising the container, reducing the impact of any escape or exploitation.

Correct Answer: Identifying when deployed infrastructure diverges from its defined configuration

Drift detection compares running infrastructure against its declared state, catching unauthorized or undocumented changes that may weaken security.

Correct Answer: Systems are replaced rather than modified, preventing drift and persistent footholds

Replacing rather than modifying instances eliminates configuration drift and destroys any attacker persistence when instances are routinely rebuilt from clean images.

Correct Answer: A developer who advocates for and supports security practices within their team

Security champions are embedded team members who promote secure practices and act as a bridge to the security team, scaling security influence across development.

Correct Answer: Sustained security depends on everyday decisions made by people across the organization

Most security outcomes depend on countless routine choices by ordinary staff, so a culture where security is valued produces better results than controls alone.