Threats, Threat Sources, and Vulnerabilities EHE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has a legacy application that is critical to operations but has a known unpatched vulnerability. Patching the application would require a full day of downtime, which would disrupt business. The application is not internet-facing but is accessible from the internal network. Which mitigation strategy best balances security and business continuity?

   • AImmediately patch the application without scheduling, accepting the downtime.
   • BDo not patch the application because the risk is low since it is not internet-facing.
   • CApply the patch during a scheduled maintenance window, and implement compensating controls such as network segmentation and monitoring until then.
   • DReplace the application immediately with a new system.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A user receives an email that appears to be from the company's IT department, asking the user to verify their password by clicking a link. The link leads to a fake login page. Which threat type and threat source combination does this represent?

   • AConfiguration vulnerability; a misconfigured email server that allows spoofing
   • BMalware; an insider who accidentally sent the email
   • CSocial engineering; an external attacker posing as a trusted entity
   • DPhysical threat; a natural disaster that disrupts email services
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is deciding how to allocate its security budget. They face two threats: a high likelihood of ransomware attacks from external cybercriminals, and a low likelihood of a disgruntled insider leaking data. The company has limited resources. Which approach best balances the risk?

   • ASpend equally on both threats because all threats are equally important.
   • BPrioritize defenses against ransomware because the likelihood is high, but also implement basic insider threat controls such as access reviews and monitoring.
   • CIgnore both threats because the company has not experienced an attack yet.
   • DFocus solely on insider threat controls because insider attacks are more damaging.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following best describes the relationship between threats and vulnerabilities?

   • AVulnerabilities create threats
   • BA vulnerability is a potential danger that can exploit a threat
   • CA threat exploits a vulnerability to cause harm
   • DThreats and vulnerabilities are independent and do not interact
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is assessing threats to its new cloud-based customer database. They identify three threats: (1) a competitor stealing data, (2) a cloud provider employee with access, and (3) a natural disaster affecting the data center. Which threat source is most difficult to defend against?

   • AThe competitor, because they are highly motivated.
   • BAll are equally difficult to defend against.
   • CThe cloud provider employee, because they have legitimate access and may bypass technical controls.
   • DThe natural disaster, because it is unpredictable.
   Reveal Solution Discussion Select an answer first