The company should use CASB for OAuth application permission control to help prevent this type of attack in the future. CASB stands for cloud access security broker, which is a software tool that monitors and enforces security policies for cloud applications. CASB can help control which third-party applications can access the company's cloud file storage service and what permissions they have. CASB can also detect and block any unauthorized or malicious applications that try to access the company's data. Verified Reference:
https://www.kaspersky.com/resource-center/threats/how-to-avoid-social-engineering-attacks
https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/understanding-preventing-social-engineering-attacks/
https://www.indusface.com/blog/10-ways-businesses-can-prevent-social-engineering-attacks/

Step by Step
A: Randomizing the keypad reduces the risk of shoulder-surfing attacks by eliminating predictable patterns.
C: Randomization increases the cognitive load on users, making it harder to input numbers quickly.
D: Additional computational power is minimal and not typically a trade-off.
E and F: Remembering access numbers or weak passwords are unrelated to keypad randomization.

Comprehensive and Detailed in-Depth
Understanding the Risk Levels:
Inherent Risk:
Theoriginal riskbefore any controls or mitigation measures are applied.
In this scenario, it represents therisk of automated purchases without CAPTCHA.
Residual Risk:
Theremaining riskaftermitigation strategieshave been applied.
After implementing CAPTCHA, some risk remains asCAPTCHA systems can be bypassedorhuman-operated botsmay still make purchases.
Mitigated Risk:
A risk that has beenreduced or managedeffectively.
While CAPTCHAmitigatesthe issue, it does noteliminateit.
Low Risk:
A risk that is consideredminordue to effective mitigation or low impact.
CAPTCHA reduces risk but does not guarantee it is low.
Transferred Risk:
A risk that has beenshifted to another entity, such asoutsourcing or insurance.
Implementing CAPTCHA does nottransfer riskbut ratherreduces it directly.
Why the Correct Answer is D (Residual):
Implementing CAPTCHAreduces the number of automated purchases, but therisk is not entirely eliminated.
There is always aresidual riskbecause:
Advanced botsmay bypass CAPTCHA systems.
Human-assisted purchasesmight still occur, as attackers might hire people to complete CAPTCHAs.
Therefore, the risk after implementing the CAPTCHA system isresidual, assome potential for automated purchases remains.
Why the Other Options Are Incorrect:
A . Inherent:
Inherent risk existsbeforeany mitigating actions, like CAPTCHA implementation.
Since the CAPTCHA is already suggested, we are addressing theresidual risk.
B . Low:
While CAPTCHA reduces the risk, itdoes not eliminate it completelyor make it negligible.
Attackers can stillbypass CAPTCHAusing more sophisticated methods.
C . Mitigated:
The CAPTCHA reduces risk butdoes not fully mitigate it.
The termmitigatedimplies a more comprehensive reduction than what CAPTCHA alone can provide.
E . Transferred:
There isno transfer of riskto another party or system.
CAPTCHA directlymitigatesrisk rather than shifting responsibility.
Real-World Scenario:
Whenpopular productsare released (like new GPUs), attackers usebotsto make bulk purchases.
Retailers implementCAPTCHA systemsto prevent automated orders.
However,bot developerscontinuously innovate tobypass CAPTCHA, leaving some level ofresidual risk.
Extract from CompTIA SecurityX CAS-005 Study Guide:
TheCompTIA SecurityX CAS-005 Official Study Guidedefinesresidual riskas therisk that remains after controls are implemented. Implementing aCAPTCHAsystem reduces thelikelihoodof automated purchases butdoes not fully eliminate the threat, thus leaving aresidual risk.

In a PaaS implementation, the provider offers relief to the organization's teams by sharing in many of the operational duties related to the application/platform software. The provider is responsible for securing and maintaining the underlying infrastructure, operating systems, middleware, runtime environments, and other software components that support the platform and the applications running on it. The provider also handles tasks such as patching, updating, scaling, and backing up the platform software.
A) Application-specific data assets are the responsibility of the organization in a PaaS implementation. The organization owns and controls its own data and must ensure its confidentiality, integrity, and availability. The organization must also comply with any applicable data protection laws and regulations.
B) Application user access management is the responsibility of the organization in a PaaS implementation. The organization must define and enforce its own policies and procedures for granting, revoking, and monitoring access to its applications and data. The organization must also ensure that its users follow security best practices such as strong passwords and multifactor authentication.
C) Application-specific logic and code are the responsibility of the organization in a PaaS implementation. The organization must develop, test, deploy, and manage its own applications using the tools and services provided by the platform. The organization must also ensure that its applications are secure, reliable, and performant.
https://www.techtarget.com/searchcloudcomputing/feature/The-cloud-shared-responsibility-model-for-IaaS-PaaS-and-SaaS