Threat and Vulnerability Management ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security operations center (SOC) receives a threat intelligence report about a new banking trojan that uses a specific domain for command-and-control (C2). The SOC wants to proactively protect the organization. Which action is the most effective use of this intelligence?

   • ASend a company-wide email warning employees about the banking trojan.
   • BConduct a full vulnerability scan of all internet-facing systems.
   • CAdd the C2 domain to the DNS sinkhole and create an alert rule in the SIEM for any traffic to that domain.
   • DWait for the antivirus vendor to update signatures before taking any action.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of generating regular vulnerability management reports for stakeholders?

   • ATo communicate the status of vulnerabilities and remediation progress
   • BTo automatically remediate all identified vulnerabilities
   • CTo satisfy all regulatory compliance requirements
   • DTo replace the need for technical vulnerability scans
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A financial services firm has noticed an increase in ransomware attacks in its industry. The threat intelligence team has identified a specific ransomware group that uses a known exploit chain to gain initial access. The firm wants to proactively reduce its risk. Which action is most aligned with threat landscape analysis?

   • AIncrease the frequency of full backups and test restoration procedures.
   • BPurchase additional cyber insurance to cover potential ransom payments.
   • CConduct a general security awareness training for all employees.
   • DPrioritize patching of the specific vulnerabilities used in the exploit chain and implement detection rules for the ransomware's indicators of compromise.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security operations center (SOC) receives a threat intelligence feed that includes a new indicator of compromise (IOC) for a malware family that uses a specific domain for command-and-control. The SOC wants to proactively defend against this threat. Which action should the SOC take first?

   • ASend a notification to all employees warning them about the malware and advising them not to visit the domain.
   • BConduct a full vulnerability scan of all endpoints to identify any systems that may be affected by the malware.
   • CWait for the threat intelligence feed to provide more context before taking any action.
   • DAdd the domain to the organization's DNS blocklist and create a detection rule in the SIEM to alert on any traffic to that domain.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst has identified a critical vulnerability in a database that contains sensitive customer information. The vulnerability has a CVSS score of 9.0, but the database is behind a firewall that restricts access to only a few internal applications. The analyst also found a high-severity vulnerability in a public-facing web server with a CVSS score of 7.5 that is exposed to the internet. Which vulnerability should be remediated first?

   • ABoth vulnerabilities simultaneously, because both are critical and should be fixed immediately.
   • BNeither vulnerability, because the firewall and other controls provide sufficient protection.
   • CThe database vulnerability, because it has a higher CVSS score and contains sensitive data.
   • DThe web server vulnerability, because it is internet-facing and has a higher likelihood of exploitation.
   Reveal Solution Discussion Select an answer first