Threat Assessment with Attack Surface Analysis CND Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company runs a legacy application that requires an old protocol (Telnet) to be enabled on a server for a specific administrative function. The server is also running a web server on port 80 that is no longer used, and a database that listens on a non-standard port. The security team wants to reduce the digital attack surface while keeping the legacy application functional.

   • AKeep all services as they are but add a firewall rule to block external access to the database port.
   • BDisable the unused web server and restrict Telnet access to specific administrative IP addresses.
   • CMove the database to a different server and leave the web server running.
   • DReplace Telnet with SSH for the administrative function.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network administrator is reviewing the services running on a server. The server has an SSH service on port 22, a web server on port 80, a database on port 3306, and a legacy FTP service on port 21. The FTP service is no longer used by any application. Which action most effectively reduces the digital attack surface?

   • AKeep the FTP service enabled but restrict it to a single IP address.
   • BMove the FTP service to a different server.
   • CDisable the FTP service and remove the associated firewall rule.
   • DChange the FTP service to listen on a non-standard port.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is concerned about insider threats. An employee with administrative privileges has access to sensitive customer data. Which attack surface reduction strategy is most effective?

   • AImplement the principle of least privilege and require dual approval for sensitive data access.
   • BMonitor employee email for suspicious content.
   • CConduct background checks on all new employees.
   • DIncrease the frequency of security awareness training.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the context of network defense, what does the term 'attack surface' refer to?

   • AThe list of all employees who have administrative privileges on the network
   • BThe set of all known malware signatures used by antivirus software
   • CThe physical perimeter of a data center, including walls, doors, and fences
   • DThe total sum of vulnerabilities and entry points in a system or network
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network defender is tasked with performing an attack surface analysis for a mid-sized company. The company recently deployed a new web application that listens on TCP 443, opened a management port (TCP 3389) to the internet for remote administration, and employees regularly use personal USB drives. The defender must identify the most comprehensive starting point for mapping the attack surface.

   • ARun a vulnerability scanner against the web application and patch any findings.
   • BInventory all network-accessible services, open ports, and protocols, then correlate them with the web application and remote management interfaces.
   • CDisable the remote desktop port immediately and then review the web application code for vulnerabilities.
   • DInterview employees about their use of personal USB drives and social media habits.
   Reveal Solution Discussion Select an answer first