Threat and Vulnerability Management ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which vulnerability identification technique is best suited for discovering security flaws in custom-built application source code before the application is deployed?

   • AStatic code review
   • BNetwork vulnerability scanning
   • CPenetration testing
   • DSocial engineering assessment
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization's threat intelligence team has identified a new exploit kit that is being delivered through malicious advertisements on popular websites. The team wants to reduce the risk of infection. Which proactive measure is most effective?

   • ABlock known malicious advertising domains and enable web filtering to prevent access to compromised ad networks.
   • BIncrease the frequency of full system backups.
   • CDisable JavaScript in all browsers across the organization.
   • DWait for the next scheduled vulnerability scan to identify any affected systems.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team has identified the following vulnerabilities in a corporate environment: a critical vulnerability in a public-facing web server, a high vulnerability in an internal file server, and a medium vulnerability in a test lab. The team has a maintenance window of only two hours this weekend. Which vulnerability should be remediated first?

   • AThe medium vulnerability in the test lab.
   • BThe high vulnerability on the internal file server.
   • CThe critical vulnerability on the public-facing web server.
   • DAll three vulnerabilities, because all must be fixed as soon as possible.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small business has a legacy application that is critical to operations but cannot be patched because the vendor is out of business. The application runs on a Windows Server 2008 system that is no longer supported. The business cannot afford to replace the application in the near term. Which remediation strategy is most appropriate?

   • APlace the legacy system on a separate network segment with strict firewall rules that only allow necessary communication.
   • BDisable the legacy application and use a manual process until a replacement is found.
   • CIncrease the frequency of backups and hope that the system is not compromised.
   • DUpgrade the operating system to a newer version while keeping the legacy application.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A software development team is preparing to release a new web application. The security team wants to identify vulnerabilities early in the development lifecycle. Which approach is most effective for this purpose?

   • ARun a network vulnerability scan against the staging server.
   • BConduct a penetration test on the production environment after the release.
   • CWait for the first security incident to identify vulnerabilities.
   • DPerform a static application security testing (SAST) scan during the code review phase.
   Reveal Solution Discussion Select an answer first