Audits and Compliance N10-009 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   During an audit, a technician runs a vulnerability scan that produces thousands of findings, many of which are false positives. The auditor needs to focus on genuine, exploitable vulnerabilities. Which approach would BEST refine the scan results?

   • ARely solely on the scanner's built-in risk ratings
   • BDisable all findings rated below critical severity
   • CCorrelate scan results with manual verification and exploitability analysis
   • DIncrease the scan intensity to capture more detailed results
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is preparing for a HIPAA compliance audit. The risk assessment identifies that patient data is transmitted unencrypted between two branch offices over a leased line. The data is at risk of interception. Which remediation should be prioritized in the remediation plan?

   • AUpgrade the leased line to a higher bandwidth connection
   • BAdd a firewall at each branch office
   • CImplement IPsec VPN between the branch offices
   • DImplement MAC address filtering on the switches
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An audit report identifies three critical findings: (1) default credentials on network devices, (2) missing security patches on servers, and (3) lack of network segmentation between departments. The remediation budget is limited and cannot cover all fixes immediately. Which remediation strategy BEST balances risk reduction and resource constraints?

   • AAddress all three findings simultaneously with equal priority
   • BImplement segmentation first, then address credentials and patches
   • CPatch servers first, then fix credentials, then segmentation
   • DFix default credentials first, then patches, then segmentation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company must maintain continuous compliance with a regulatory standard that requires real-time alerting on unauthorized access attempts. The security team currently reviews logs manually at the end of each week. Which improvement would BEST meet the compliance requirement?

   • AStore logs for a longer retention period
   • BDeploy a SIEM solution with automated alerting
   • CIncrease log review frequency to daily
   • DAssign a dedicated analyst to monitor logs during business hours
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   After a network audit, the compliance officer requests a report that shows the status of all findings, including those remediated, those in progress, and those not yet started. The report will be reviewed by both technical staff and executive leadership. Which report format BEST meets this need?

   • AA single spreadsheet listing all findings with technical details only
   • BA dashboard with status categories and a summary for executives, plus detailed findings for technical staff
   • CA report that lists only the remediated findings
   • DA verbal summary presented in a meeting without written documentation
   Reveal Solution Discussion Select an answer first