Threat Assessment with Attack Surface Analysis CND Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of continuous attack surface monitoring?

   • ATo replace the need for regular security assessments
   • BTo detect changes in the attack surface and identify new vulnerabilities
   • CTo automatically patch all vulnerabilities without human intervention
   • DTo ensure that all employees are following security policies
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A network defender is responsible for continuously monitoring the attack surface of a cloud-hosted application. The application's public IP address, load balancer, and security groups are managed by the cloud provider. The defender wants to detect new exposure as soon as it appears, such as an accidentally opened security-group port or a new public endpoint.

   • APerform a manual review of security groups and load balancer rules once per quarter.
   • BRun a vulnerability scanner against the application's public IP address every week.
   • CConfigure automated configuration and compliance scanning that alerts on changes to security groups, load balancer rules, and public endpoints.
   • DSubscribe to a threat-intelligence feed that lists known malicious IP addresses.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a step in the attack surface analysis process?

   • APurchasing new security software
   • BTraining employees on security awareness
   • CDisabling all unnecessary services immediately
   • DEvaluating attack vectors to determine their risk
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's security team is conducting an attack surface analysis and wants to reduce the social attack surface. Employees frequently receive phishing emails, and a recent incident involved an employee sharing credentials over the phone with someone posing as IT support. The team has limited budget and must choose the most effective control to reduce this surface.

   • ADisable caller ID and require all phone calls to go through a central switchboard.
   • BImplement a security awareness training program that includes phishing simulations and phone-based social engineering scenarios.
   • CDeploy an email gateway that blocks all external emails to reduce phishing exposure.
   • DRequire multi-factor authentication (MFA) on all accounts.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A cloud-native company runs hundreds of microservices in a Kubernetes cluster. Each microservice exposes an API endpoint, and the company uses a service mesh for internal communication. The security team wants to continuously monitor the attack surface for new API endpoints and misconfigurations. They have a DevOps culture and want to integrate monitoring into their CI/CD pipeline.

   • AIntegrate an API discovery and security tool into the CI/CD pipeline that automatically catalogs new endpoints and checks for misconfigurations.
   • BUse a vulnerability scanner that runs once a week against the Kubernetes cluster.
   • CPerform a manual review of all API endpoints at the end of each sprint.
   • DDeploy a network intrusion detection system (IDS) that monitors traffic between microservices.
   Reveal Solution Discussion Select an answer first