Threat and Vulnerability Management ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security manager is designing a vulnerability management reporting process. The process must provide actionable information to different audiences: the executive team, IT operations, and the security team. Which approach is most effective?

   • AProvide only the executive summary to all audiences to keep it simple.
   • BCreate separate reports for each audience, with executives seeing high-level metrics, IT operations seeing technical details, and the security team seeing trend analysis.
   • CSend the same detailed report to all audiences to ensure consistency.
   • DPublish all reports on a shared drive and let each audience access what they need.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is an indicator of compromise (IoC) in the context of threat intelligence?

   • AA piece of forensic data, such as a file hash or IP address, that suggests a system may be compromised
   • BA security control designed to prevent attacks
   • CA compliance requirement from a regulatory framework
   • DA vulnerability score assigned by CVSS
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is deploying a new web application and wants to identify vulnerabilities that could be exploited by an attacker. The team has access to the source code and a staging environment. Which combination of methods would provide the most comprehensive vulnerability identification?

   • AOnly a penetration test of the production environment after deployment.
   • BOnly a manual code review by the development team.
   • COnly a network vulnerability scan of the staging environment.
   • DStatic application security testing (SAST) on the source code and dynamic application security testing (DAST) on the staging environment.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A vulnerability scan identifies a missing security patch on a server that hosts a critical database. The patch requires a reboot, which would cause downtime. The database cannot be taken offline during business hours. Which remediation approach is most appropriate?

   • AReplace the database server with a new one that already has the patch applied.
   • BSchedule the patch installation during the next approved maintenance window and implement a compensating control, such as network segmentation, in the meantime.
   • CIgnore the patch because the server is critical and cannot be rebooted.
   • DApply the patch immediately during business hours because the vulnerability is critical.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst has identified the following vulnerabilities in a corporate environment: - A critical remote code execution (RCE) vulnerability in an internet-facing web server with a CVSS score of 9.8, but the server is scheduled for decommissioning in two months. - A high-severity SQL injection flaw in an internal customer database that is actively used by the sales team. - A medium-severity misconfiguration in a firewall that allows unnecessary inbound traffic to a non-critical development network. Given limited remediation resources, which vulnerability should be addressed first?

   • AThe SQL injection in the internal customer database, because it is actively used and could lead to data breach.
   • BThe critical RCE on the internet-facing web server, because it has the highest CVSS score.
   • CThe firewall misconfiguration, because it is quick and easy to fix.
   • DAll three simultaneously, because all vulnerabilities should be remediated as soon as possible.
   Reveal Solution Discussion Select an answer first