Vulnerability Scanning and Assessment EHE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst needs to assess the risk from an insider threat. The analyst wants to identify vulnerabilities that an authenticated user could exploit on the internal network. Which type of scan should be performed?

   • AUnauthenticated external scan
   • BAuthenticated external scan
   • CAuthenticated internal scan
   • DUnauthenticated internal scan
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A vulnerability scan of a mixed environment (Windows and Linux) reports a critical vulnerability in a third-party application. The analyst verifies that the application is not actually installed on any scanned host. The scan also reports a high-risk vulnerability in a Linux kernel module that is not loaded. The analyst must prioritize remediation efforts. What is the best course of action?

   • ATreat both findings as real and remediate them immediately.
   • BTreat both findings as false positives and remove them from the report.
   • CTreat the third-party application finding as a false positive, but investigate the kernel module finding further.
   • DIgnore both findings because the scanner is unreliable.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is explaining the role of vulnerability scanning to a new team member. The analyst wants to emphasize that vulnerability scanning is a proactive measure. Which statement best describes this role?

   • AVulnerability scanning identifies potential weaknesses before they are exploited
   • BVulnerability scanning is used to respond to an active attack
   • CVulnerability scanning is the same as penetration testing
   • DVulnerability scanning is only performed after a breach
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the ethical hacking methodology, what is the primary purpose of vulnerability scanning?

   • ATo remove all detected vulnerabilities from the target environment automatically
   • BTo verify that all security patches have been applied and no misconfigurations exist
   • CTo actively exploit identified weaknesses and gain access to the target system
   • DTo systematically identify and assess security weaknesses in systems, networks, or applications
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What should be included in a vulnerability assessment report to help stakeholders understand the overall risk?

   • AThe complete source code of all scanned applications
   • BAn executive summary with risk ratings and key findings
   • CA list of all network usernames and passwords
   • DThe personal contact information of all employees
   Reveal Solution Discussion Select an answer first