Threat Assessment with Attack Surface Analysis CND Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network defender is assessing the physical attack surface of a corporate office. The office has a server room with a badge reader, but the door is often propped open for convenience. Additionally, unattended laptops are left logged in at desks, and a USB charging station in the lobby is accessible to visitors. The defender must prioritize the most critical physical attack surface issue.

   • AAll three issues are equally critical and should be addressed simultaneously.
   • BThe server room door being propped open, as it allows unauthorized physical access to critical infrastructure.
   • CThe unattended logged-in laptops, as they allow immediate access to user accounts and data.
   • DThe USB charging station in the lobby, as it could be used to install malware on visitor devices.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A network defender is explaining the concept of attack surface to a new security analyst. The analyst asks, 'Why do we consider both the web server and the employees as part of the attack surface?' The defender should respond that the attack surface includes:

   • AOnly the vulnerabilities that have known exploits, not the entry points themselves.
   • BOnly the digital elements, such as the web server, because physical and social elements are not technically exploitable.
   • CThe network perimeter, including firewalls and routers, but not internal systems or people.
   • DAll vulnerabilities and entry points, including digital elements like the web server and social elements like employees.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network defender is reviewing the attack surface of a small e-commerce company. The company hosts a web application on a single server that also runs a legacy FTP service for internal file transfers. The FTP service is not used by any external partner. The defender wants to reduce the digital attack surface with minimal business disruption. Which action should the defender take first?

   • AApply the latest security patches to the FTP service and leave it enabled for internal use.
   • BConduct a vulnerability scan of the FTP service to identify potential exploits.
   • CDisable the legacy FTP service and move internal file transfers to a secure, authenticated file-sharing solution.
   • DPlace the FTP service behind a firewall rule that only allows internal IP addresses.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has a hybrid network with on-premises servers and cloud instances. The security team wants to continuously monitor the attack surface for new services and open ports. They have a limited budget and need a solution that provides near-real-time visibility without requiring manual effort.

   • ADeploy a network-based intrusion detection system (IDS) that monitors traffic for suspicious activity.
   • BAsk administrators to manually document any new services they deploy.
   • CUse a cloud security posture management (CSPM) tool that continuously scans cloud configurations and integrates with on-premises asset discovery.
   • DSchedule a monthly vulnerability scan of all IP addresses using an open-source scanner.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is considered a physical attack surface element?

   • AA phishing email sent to employees
   • BA weak password on an administrator account
   • CAn open database port exposed to the internet
   • DA USB port on a public-facing kiosk
   Reveal Solution Discussion Select an answer first