2.1 Compare Attack Surface and Vulnerability 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is evaluating a newly discovered vulnerability in a network device. The device is not directly accessible from the internet but is accessible from the internal network. Which statement best describes the risk?

   • AThe vulnerability is a risk only if the device has a public IP address.
   • BThe vulnerability is still a risk because an attacker who gains internal access could exploit it.
   • CThe vulnerability is automatically mitigated by the internal firewall.
   • DThe vulnerability is not a risk because the device is not internet-facing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst discovers that a legacy application has a known remote code execution vulnerability. The vendor has not released a patch, and the application is critical to business operations. Which action should the analyst take first?

   • AImmediately shut down the application to eliminate the vulnerability.
   • BIgnore the vulnerability until the vendor releases a patch.
   • CUninstall the application and replace it with an open-source alternative.
   • DDocument the vulnerability and implement compensating controls such as network segmentation and access restrictions.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which set of items best represents the three main components of an attack surface?

   • ANetwork, software, and human
   • BAuthentication, authorization, and accounting
   • CHardware, firmware, and operating system
   • DPerimeter, internal, and cloud
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement correctly defines a vulnerability in the context of cybersecurity?

   • AA control that is implemented to protect a system from attacks
   • BA weakness in a system or its design that could be exploited by a threat actor
   • CA person who attempts to gain unauthorized access to a system
   • DA potential entry point that an attacker could use to access a system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is expanding its online presence by adding a customer portal, a mobile app backend, and a partner API. The security team is asked to assess the change in attack surface. Which statement best describes the impact?

   • AThe attack surface cannot be determined until a vulnerability scan is performed.
   • BThe attack surface decreases because the new services are modern and more secure.
   • CThe attack surface increases because new network-accessible services and interfaces are added.
   • DThe attack surface stays the same because the new services are protected by the same firewall.
   Reveal Solution Discussion Select an answer first