Use Threat Intelligence Techniques to Identify Potential Network Vulnerabilities 100-160 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a best practice for securing documentation that contains sensitive information?

   • AImplement role-based access control (RBAC) so only authorized personnel can view or edit
   • BUse simple passwords like 'password123' for document protection
   • CKeep the documentation in an unencrypted spreadsheet on a shared drive
   • DShare the documentation with all employees to ensure transparency
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is reviewing a newly published CVE for a web application framework used by the company. The CVE entry lists a CVSS score of 9.8 and states that exploitation is 'possible remotely without authentication.' However, the analyst notices the CVE was published only 24 hours ago and the vendor has not yet released a patch. The analyst must decide how to prioritize this vulnerability in the remediation queue. What is the most appropriate action based on threat intelligence best practices?

   • ATreat it as a critical risk and immediately apply compensating controls while monitoring for exploit activity, because the high CVSS score and remote exploitability indicate urgency even before a patch exists.
   • BWait for the vendor to release a patch before taking any action, because applying mitigations without an official fix could break the application.
   • CDowngrade the severity because the CVE is too new to be reliable and the CVSS score may change.
   • DIgnore the CVE until it appears in a threat intelligence feed, because only confirmed active exploits should drive prioritization.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A network administrator hears from a colleague at another company about a zero-day vulnerability in a network switch model that the administrator's company also uses. The colleague says the vendor is aware but has not released a patch. The administrator wants to protect the network while waiting for the patch. The administrator has limited authority to make changes and must document any actions. What is the most appropriate course of action?

   • AImmediately disconnect all affected switches from the network to prevent exploitation.
   • BShare the information on a public forum to warn other organizations, without verifying it.
   • CIgnore the information because it is not from an official source and no patch is available.
   • DDocument the information, report it to the security team, and implement temporary network-level mitigations such as access control lists if approved.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security operations center (SOC) uses an automated vulnerability management platform that ingests threat intelligence feeds and scans the network daily. The platform generates a large number of alerts, many of which are false positives. The SOC team is overwhelmed and is considering disabling some automated features. What is the best way to improve the efficiency of the automated threat intelligence process?

   • AIgnore all alerts from the platform for a week to see which ones are truly important.
   • BIncrease the frequency of scans to gather more data, which will help filter out false positives.
   • CTune the platform's correlation rules and asset criticality ratings to reduce false positives while maintaining coverage.
   • DDisable all automated scanning and rely on manual vulnerability assessments.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst is monitoring multiple threat intelligence sources for information about a new ransomware campaign. A commercial feed reports that the campaign targets a specific VPN appliance, while a free blog claims it targets a different product. The analyst also sees a post on a social media forum from an unknown user claiming the campaign is a hoax. The organization uses both VPN products. What should the analyst do?

   • AIgnore the free blog because free sources are always less reliable than paid ones.
   • BTrust the social media post because it is the most recent information.
   • CTreat both VPN products as potentially vulnerable and verify the information with the vendors before taking action.
   • DTrust the commercial feed because it is a paid subscription and therefore more reliable.
   Reveal Solution Discussion Select an answer first