Vulnerability Scanning and Assessment EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is asked to scan a network that contains both internal and external systems. The analyst wants to compare the risk from external attackers versus internal threats. Which combination of scans should be performed?

   • AOnly unauthenticated external scans
   • BUnauthenticated external scan and authenticated internal scan
   • CAuthenticated external scan and unauthenticated internal scan
   • DOnly authenticated internal scans
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After a vulnerability assessment, a security analyst has a list of findings. The analyst must present the results to the IT manager, who needs to understand the overall risk and decide which vulnerabilities to remediate first. What is the most effective way to present the findings?

   • AProvide a prioritized report with risk ratings and recommended remediation steps
   • BProvide only the critical vulnerabilities and omit the rest
   • CProvide a list of all vulnerabilities sorted alphabetically
   • DProvide a raw scan output file for the manager to analyze
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A vulnerability scan identifies a critical remote code execution vulnerability on a server. The server is a domain controller that also hosts a legacy application. The security team must remediate the vulnerability, but the only available patch is known to cause compatibility issues with the legacy application. The application is used by a critical business unit. What is the best course of action?

   • AIsolate the server from the network and apply the patch later
   • BApply the patch immediately without testing
   • CDo not apply the patch to avoid breaking the legacy application
   • DApply the patch during a maintenance window and have a rollback plan ready
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A vulnerability scan of a corporate network reports a critical vulnerability on a legacy application server. The scanner also flags a 'high' vulnerability on a modern web server. Manual verification confirms the critical finding is a false positive because the server is not actually exposed to the network. The high finding is confirmed as a real vulnerability but requires a patch that may cause downtime. The server is business-critical and cannot be taken offline during business hours. What should the security team do first?

   • ARe-run the scan with different credentials to confirm the false positive
   • BDocument the false positive and schedule the patch for the next maintenance window
   • CIgnore the false positive and focus only on the critical finding
   • DImmediately patch the web server despite the risk of downtime
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A vulnerability scan of a network reports a high-severity vulnerability on a database server. The scan also reports a medium-severity vulnerability on a web server. The database server is not directly accessible from the internet, but the web server is. The security team has limited resources and must decide which to remediate first. What should the team do?

   • APrioritize the database server vulnerability because it is high severity
   • BPrioritize the web server vulnerability because it is externally accessible
   • CRemediate both vulnerabilities simultaneously
   • DIgnore both vulnerabilities because they are not confirmed
   Reveal Solution Discussion Select an answer first