Vulnerability Management SY0-701 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is conducting a vulnerability assessment of a new application. The team has a limited budget and must choose between an automated vulnerability scanner and a manual penetration test. The application is critical and handles sensitive data. What is the most important factor to consider when making this decision?

   • AThe speed at which the assessment can be completed
   • BThe cost of the assessment
   • CThe ability to generate a report for management
   • DThe depth of coverage and the ability to identify complex, logic-based vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a technique used to identify vulnerabilities by simulating an attacker's actions without actually exploiting them?

   • APenetration testing
   • BVulnerability scanning
   • CRed teaming
   • DThreat hunting
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A vulnerability scan of a company's network has identified a critical vulnerability in a database server that is directly accessible from the internet. The database contains sensitive customer data. The security team has a limited maintenance window and must decide which vulnerability to remediate first. The scan also found a high-severity vulnerability in an internal file server that is not accessible from the internet. Which vulnerability should be remediated first?

   • AThe critical vulnerability in the internet-facing database server
   • BBoth vulnerabilities at the same time
   • CThe high-severity vulnerability in the internal file server
   • DThe vulnerability that is easier to patch
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security administrator has applied a configuration change to remediate a vulnerability on a network device. The administrator wants to confirm the change was effective without waiting for the next scheduled scan. What should the administrator do?

   • ARun a targeted scan against the specific device to verify the vulnerability is gone
   • BReview the device's configuration logs to confirm the change was applied
   • CCheck the vendor's documentation to confirm the configuration is correct
   • DWait for the next scheduled scan to see if the finding is still present
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is planning a vulnerability assessment for a new web application. The team wants to identify common misconfigurations and known vulnerabilities without causing any disruption to the application. Which type of scan should they use?

   • AA non-intrusive, unauthenticated external scan
   • BA passive network traffic analysis
   • CAn intrusive, authenticated internal scan
   • DA penetration test that attempts to exploit vulnerabilities
   Reveal Solution Discussion Select an answer first