Threat and Vulnerability Management ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational corporation has identified a sophisticated APT group that has been targeting its industry. The APT is known to use zero-day exploits and custom malware. The corporation has a mature vulnerability management program but is struggling to prioritize its defenses. The CISO wants to focus on the most effective approach. Which strategy is most appropriate?

   • APurchase additional threat intelligence feeds and rely solely on them to identify the APT's activities.
   • BFocus exclusively on patching all known vulnerabilities as quickly as possible, because zero-day exploits are rare.
   • CInvest in threat hunting and deception technologies to detect the APT's presence, while maintaining a strong patch management program for known vulnerabilities.
   • DDisconnect all internet-facing systems from the network to prevent any external attacks.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When a vendor patch for a critical vulnerability is not yet available, which remediation approach can be used to reduce the risk of exploitation in the meantime?

   • AImplement a compensating control
   • BApply the vendor patch
   • CPerform a code review
   • DDisable the system entirely
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is conducting a vulnerability assessment of a web application. They have limited time and need to identify the most critical vulnerabilities. The team has access to the application's source code and a staging environment. Which combination of methods is most efficient for this task?

   • AReview the source code manually without using any automated tools.
   • BRun a DAST scan against the staging environment and then patch all findings immediately.
   • CConduct a full penetration test on the production environment.
   • DRun a SAST scan on the source code and then manually verify the findings in the staging environment.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is reviewing a threat intelligence report that describes a new phishing campaign targeting employees in the finance department. The report includes the subject lines used, the sender domains, and the malicious payloads. Which action should the team take to integrate this intelligence into their vulnerability management process?

   • AConduct a vulnerability scan of the finance department's workstations to identify any missing patches.
   • BUpdate the email gateway filters to block the sender domains and subject lines, and create a SIEM rule to alert on any emails that match these indicators.
   • CSend a general security awareness email to all employees about phishing risks.
   • DWait for the threat intelligence feed to provide more detailed indicators before taking action.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a legacy application that is critical to operations but has known vulnerabilities that cannot be patched because the vendor is out of business. The application is accessible only from the internal network. The security team must reduce risk without disrupting operations. Which combination of compensating controls is most effective?

   • APlace the application on the internet to allow remote access for employees.
   • BDisable the application and use a manual process instead.
   • CRely on antivirus software on the server.
   • DNetwork segmentation, strict access controls, and host-based intrusion prevention.
   Reveal Solution Discussion Select an answer first