Threat Assessment with Attack Surface Analysis CND Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A hospital has a mix of legacy medical devices that cannot be patched and modern IT systems. The security team must reduce the attack surface while ensuring the medical devices remain functional. Which strategy is most effective?

   • ASegment the legacy devices onto a separate network with strict firewall rules and monitor traffic.
   • BConnect the legacy devices directly to the internet for remote monitoring.
   • CDisable the legacy devices and rely on manual processes.
   • DReplace all legacy devices with modern, patchable equivalents.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is an example of a physical attack surface element?

   • AA web server running an outdated version of Apache
   • BAn unlocked network closet containing switches and routers
   • CA misconfigured firewall rule allowing inbound traffic on port 22
   • DAn employee who shares passwords with coworkers
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A manufacturing plant has industrial control systems (ICS) that are connected to the corporate network for monitoring. The plant manager wants to reduce the physical attack surface without disrupting production. Which action is most effective?

   • AImplement network segmentation with a firewall between the ICS and corporate network, and restrict physical access to ICS terminals.
   • BAdd more security cameras to monitor the plant floor.
   • CReplace all ICS devices with newer models that have better security.
   • DDisconnect the ICS from the corporate network entirely.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company has a hybrid network with on-premises servers and cloud instances. The security team wants to monitor the attack surface for unexpected changes, such as new open ports or unauthorized devices. Which monitoring method is most effective?

   • APerform a penetration test once a year to identify new vulnerabilities.
   • BUse automated configuration management tools that continuously compare current configurations to a secure baseline and alert on drift.
   • CConduct a quarterly manual review of firewall rules and server configurations.
   • DDeploy a network intrusion detection system (IDS) that alerts on suspicious traffic.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard · select all that apply

   A network defender is performing an attack surface analysis for a hospital. The hospital has a patient portal (web application), a medical device network (physical devices), and a staff training program (social). The defender must identify all relevant attack vectors across these surfaces. Which of the following are valid attack vectors to include in the analysis? (Select all that apply.)

   • AExploiting a vulnerability in the patient portal's web application.
   • BDeleting a firewall rule to allow unauthorized network traffic.
   • CGaining physical access to a medical device to tamper with its settings.
   • DInstalling a new operating system on a server.
   • EPhishing a staff member to obtain their credentials.
   Check answers Discussion Select an answer first