Vulnerability and Threat Management GCIL Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A vulnerability assessment identified several critical vulnerabilities in different business units. The security team needs to communicate the findings to the business unit managers, who have different risk appetites and budgets. What is the most effective communication strategy?

   • ASend the same detailed technical report to all managers to ensure consistency.
   • BPresent only the highest-severity vulnerability to all managers to avoid overwhelming them.
   • CTailor the report for each business unit, focusing on the vulnerabilities that affect their systems and the business impact.
   • DAsk the managers to review the full scan report and prioritize their own fixes.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has identified a critical vulnerability in a customer-facing application. The vulnerability is not currently exploited, but the company's threat intelligence indicates that exploitation is likely in the near future. The incident leader must communicate this finding to the executive team and recommend a course of action. The executive team is concerned about the cost of immediate remediation and the potential impact on customer experience. Which recommendation should the incident leader make?

   • ARecommend immediate remediation despite the cost, explaining the likelihood of exploitation and the potential business impact.
   • BRecommend implementing a temporary workaround that reduces risk without the full cost of remediation.
   • CRecommend accepting the risk and documenting the decision in the risk register.
   • DRecommend deferring remediation until the vulnerability is actually exploited to avoid unnecessary costs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A critical vulnerability is found in a legacy application that the vendor no longer supports. The application is essential to daily operations and cannot be replaced for several months. Which remediation approach is most appropriate in the interim?

   • AAsk the vendor for an unofficial patch.
   • BUninstall the application immediately to eliminate the risk.
   • CImplement compensating controls such as network segmentation and strict access controls around the application.
   • DIgnore the vulnerability until the application can be replaced.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large e-commerce company is redesigning its payment processing system. The security team is conducting a threat modeling exercise using the STRIDE methodology. During the exercise, the team identifies a threat where an attacker could tamper with transaction data in transit between the web server and the payment gateway. The team is considering two controls: enabling TLS 1.3 with certificate pinning, and implementing a message authentication code (MAC) on the application layer. The incident leader must decide which control to prioritize. Which consideration should drive the decision?

   • ABoth controls are equally effective, so the decision should be based on implementation cost.
   • BNeither control is sufficient because the threat model does not account for insider threats.
   • CAn application-layer MAC is the preferred control because it provides end-to-end integrity that is independent of the transport layer.
   • DTLS 1.3 with certificate pinning is the preferred control because it addresses the tampering threat at the transport layer and is a widely accepted standard.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A vulnerability assessment identified a SQL injection flaw in a web application. The application is behind a WAF that blocks common SQL injection payloads. How should the team evaluate the severity of this finding?

   • ATest whether the WAF can be bypassed with encoded or obfuscated payloads.
   • BIgnore the finding because the WAF is a compensating control.
   • CAssume the WAF fully mitigates the vulnerability and close the finding.
   • DIncrease the severity because the application is behind a WAF.
   Reveal Solution Discussion Select an answer first