Exam SY0-601 topic 1 question 424 discussion

Does anyone proofread these questions for grammar or legibility? I feel like I am drunk reading this question.

D- I would think outsourcing code would be the biggest security concern. This is another weird comptia question

the POINT is Customer... Customer with UI developer concerned is configuration security is important more than the code. For coding concerned should be vendor with UI developer.

I will say A. Weak Configurations outside or not is a concern in my book

Let me confuse everybody. My instinct says D. But comptia sg page 256 says "In some cases, application developers, vendors, and systems administrators make it easy for an attacker. Systems often ship with default administrative accounts that may remain unchanged. For example, Figure 6.11 shows a section of the manual for a Zyxel router that includes a default username and password as well as instructions for changing that password."

I would assume that the customer outsourced the code development because they thought the external party would be doing a great job in code development; this negates the issue of weak configurations. The question would be how to ensure that they have the necessary NDA in place to ensure the secrecy of the codes due to the sensitive nature of the project. My choice is D.

The reason I lean towards Weak configurations is this: While Outsourced code development involves bringing in external individuals or firms to handle software development, it doesn't automatically equate to vulnerabilities. However, Weak configurations pose a direct risk, potentially leading to vulnerabilities within the system. So (A), Weak configurations would be my biggest concern.

While outsourced code development is indeed a concern for customers involved in UI developer agreements, it's not directly related to the use of the products on highly sensitive projects. The concern with outsourced code development generally revolves around issues like code quality, reliability, and adherence to specifications. However, for highly sensitive projects, ensuring the security of user accounts is paramount, as any compromise in user account security could lead to unauthorized access to sensitive data or resources. Therefore, unsecure user accounts (option C) would typically be the primary concern in such scenarios.

Originally, I figured D: outsourced code development, however, there's no indication that the UI developer would outsource their work. Weak configurations make a lot of sense with regards to storing api keys and connection strings, etc in a config file in a public facing UI (mobile apps or websites). From my experience, this is pretty common (even worse, I've seen javascript files with API keys out for the taking!).

Insecure user accounts represent a direct vulnerability where unauthorized users could gain access to the system or sensitive information through compromised accounts. This is often a more immediate and direct threat compared to weak configurations, which might leave the system vulnerable to exploitation but may not necessarily result in unauthorized access without other vulnerabilities being exploited. Therefore, addressing insecure user accounts should generally take precedence as it involves directly securing access points to the system. Once user accounts are secured, attention can be turned to addressing weak configurations to further enhance the overall security posture of the system.

Outsource code development

UI developer agreements....folks, agreements have nothing to do with weak configurations. They are most likely concerned about undocumented backdoors due to code outsourcing. D

Customers who are involved with UI developer agreements should be particularly concerned with **Outsourced Code Development** when considering the use of these products on highly sensitive projects. Outsourced code development can introduce a variety of risks, especially when dealing with sensitive projects. These risks include, but are not limited to, the potential for weak or insecure coding practices, lack of control over the development process, and potential for intellectual property theft. Therefore, it's crucial to have robust security measures and strict oversight in place when outsourcing code development. So, the correct answer is D. Outsourced Code Development.

I have to go with A. The reason is the question already states the customer is outsourcing the code development, so naturally it is a concern. Taking it a step further, what would the customer be concerned with using a 3rd party.

The main concern is, obviously, the outsourced development code.

Customers are more likely to be concerned about outsourcing than weak configuration. In fact most times they cannot tell the difference in configuration! Control is still within the developer's hands but with outsourcing, the risk compounds!

UI developer agreements most likely mean that the UI development is outsourced to a third party hence there is a need for a contract/agreement. When third party is performing code development, organisation/company should be aware of the following: • Accessing the code base – Internal access over a VPN – Cloud-based access • Verify security to other systems – The development systems should be isolated • Test the code security – Check for backdoors – Validate data protection and encryption Taken from profmesser