ITPEC FE Subject B October 2024 Question 20
From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.
Company Y, a trading company, is developing an e-commerce web application for selling products to customers directly. The web server hosting the web application is installed on-premise and the web application is to be developed in-house. The communications to the web server are allowed only with HTTPS and the server certificate is already signed by the third party and installed on the web server. Company Y has an IT department comprising three teams—Developer, Security, and Tech Support—and the requirements for the web application are specified as follows (excerpt):
- •The web application is user-friendly and easy to navigate.
- •The web application is cost-effective to develop and maintain.
- •The web application can prevent malicious inputs into the system.
- •The web application is scalable and can handle a large number of customers.
- •The purchase orders and invoices are digitally signed to confirm integrity and authenticity.
During the initial project meeting, the members from each department discuss their respective tasks. The developer team requests the security team to derive specific tasks for the above requirements related to security. Ms. B, a member of the security team, suggests the following tasks:
- •Set up a A to provide the infrastructure.
- •Install a B in front of the web server.
Answer group
Explanation
A: PKI environment, B: web application firewall — each security requirement maps to one control: digital signatures need a PKI, malicious input needs a WAF.
- •Purchase orders and invoices must be digitally signed. Signing needs key pairs and certificates that bind the public keys to their owners, issued and managed by a PKI; that is the infrastructure in A. The HTTPS server certificate protects the connection only, not the documents.
- •The application must block malicious input such as SQL injection or cross-site scripting. A web application firewall, placed in front of the web server, inspects HTTP requests and blocks such attacks; that is B.
Answer (c)
Why not others:
- •(d), (e) and (f) — an SPF record lists the servers allowed to send email for a domain; it has nothing to do with signing documents
- •(a) and (d) — a honeypot is a decoy that attracts and records attackers; it does not filter the input reaching the real server
- •(b) and (e) — a VPN gateway builds encrypted tunnels between sites or for remote staff; customers reach the shop over HTTPS, and a VPN does not inspect application input
Key rule: Match each requirement to what the control actually does: a PKI makes public keys trustworthy, a WAF filters HTTP content, and SPF authenticates mail senders.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.