ITPEC FE Subject B April 2025 Question 19
From the answer group below, select the correct combination of answers to be inserted into A and B in the description.
Company V, a small-sized company specializing in manufacturing and selling home appliances, has recently expanded its team of website administrators to five. In addition, they have renovated their website to allow customers to download user manuals for their products. One day, an external security researcher highlighted that files containing a watermark with "For Internal Use" were publicly accessible in the public directory of the company’s website and available for download. Company V has a system that ensures all documents stored in the internal folder have this watermark by default, and a rule exists stating that the watermark must be removed when files are published or shared external. The website administrator immediately confirmed the issue and removed the document from the public directory. Then, the website administrator reported this issue to Company V's security team. The investigation of the security team revealed that the issue was caused by a website administrator accidentally uploading internal documents instead of the intended public catalog files. Those publicly accessible files were a draft version of the catalogs, and they did not contain credential information such as API keys for website management. When uploading files to the website's public directory, another website administrator, other than the uploader, was supposed to verify the correctness of the files. However, they failed to notice the mistake. To prevent similar issues in the future, the security team suggested implementing A to the website administrators. Additionally, to quickly detect issues, the security team suggested implementing B.
Answer group
Explanation
A: an automated tool that blocks uploads of files watermarked "For Internal Use" to the public directory, B: periodic checks of the public directory for mistakenly exposed files — the existing watermark marks exactly the files that must not go public, and a regular scan catches whatever still slips through.
- •Cause: an administrator uploaded internal documents instead of the catalog files, and the second administrator's manual check missed it.
- •Blank A (prevent): every internal document carries the watermark by default, and the rule says it is removed before publishing, so a watermarked file in the public directory is a mistake by definition. A tool that refuses such uploads turns the rule into an automatic check that does not depend on human attention.
- •Blank B (detect): the exposure was found by an outside researcher, not by Company V. Scanning the public directory regularly for files that should not be there lets the company find such an exposure itself, and quickly.
Answer (i)
Why not others:
- •(a), (b) and (c) — refusing all uploads to public directories would also block the manuals and catalogs that must be published there; the problem was which file, not which directory
- •(d), (e) and (f) — a credential scanner looks for API keys and passwords, and the leaked drafts had none, so it would have let them through
- •(a), (d) and (g) — a two-administrator review is a preventive policy, not a way to detect, and a second-person check already existed and failed
- •(b), (e) and (h) — the public directory is open to everyone by design, so there is no unauthorized access to alert on, and the file was placed there by an authorized administrator
Key rule: Automate a check that people already failed to make, using a marker the organisation already applies, and pair it with a detective control that inspects what is actually exposed.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.