Use Threat Intelligence Techniques to Identify Potential Network Vulnerabilities 100-160 Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company wants to continuously identify vulnerabilities in its cloud infrastructure. The security team is small and cannot manually review every new CVE. They need a solution that automatically checks their cloud resources against known vulnerabilities and provides a dashboard for tracking remediation. Which approach best meets this need?

   • AUse a spreadsheet to track all known CVEs and mark which ones affect the company's assets.
   • BSubscribe to a CVE mailing list and manually compare each new CVE to the company's asset inventory.
   • CDeploy a cloud-native vulnerability management tool that integrates with the cloud provider's API and automatically scans resources on a schedule.
   • DHire a third-party penetration testing firm to perform a one-time assessment each year.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security analyst is using the NVD to research a vulnerability that was disclosed in a third-party library. The NVD entry shows a CVSS score of 7.5, but the analyst finds a vendor advisory that rates the same vulnerability as 'high' with a different CVSS score. The analyst also sees that a commercial threat intelligence feed lists the vulnerability as 'exploited in the wild.' The organization uses the library in a non-internet-facing application. What should the analyst do to prioritize remediation?

   • APrioritize remediation based on the vendor's advisory and the threat intelligence feed, because they reflect the actual risk in the organization's context.
   • BWait for the NVD entry to be updated to match the vendor's score before taking action.
   • CIgnore the vulnerability because the application is not internet-facing, so the risk is low.
   • DUse the NVD CVSS score as the sole basis for prioritization, because it is the official government source.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A small business cannot afford commercial threat intelligence feeds. The IT admin wants to use ad hoc methods to identify potential vulnerabilities. Which approach is an example of ad hoc threat intelligence?

   • AHiring a third-party penetration testing firm to conduct an annual assessment.
   • BDeploying a vulnerability scanner that runs daily and emails reports.
   • CManually checking vendor security advisories and public forums for discussions about new exploits.
   • DSetting up a SIEM to automatically correlate logs with a paid threat feed.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A vulnerability management team is using the NVD to track a newly disclosed vulnerability. They notice that the NVD entry does not yet include a CVSS score or any references. What is the most appropriate action?

   • AIgnore the vulnerability because it lacks a CVSS score, meaning it is not important.
   • BMonitor the NVD entry for updates and check vendor advisories for additional information.
   • CAssume the vulnerability is a hoax because the NVD entry is incomplete.
   • DImmediately patch all systems because the NVD entry exists.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A security analyst is reading a threat intelligence report that mentions a new malware family targeting a specific type of IoT device. The report includes a list of CVE IDs associated with the malware. Which action best uses this report to improve the organization's security posture?

   • ACheck the organization's asset inventory for the affected IoT devices and review the listed CVEs for applicable patches.
   • BAdd the malware's file hashes to the antivirus definitions and ignore the CVEs.
   • CShare the report with the IT team but take no further action because the report is about a different industry.
   • DImmediately disconnect all IoT devices from the network because they are vulnerable.
   Reveal Solution Discussion Select an answer first