Vulnerability and Threat Management GCIL Practice Questions (Page 10)

Questions 46–48

1. 46foundation · easy

   In the STRIDE threat modeling framework, which threat category is concerned with an attacker being able to modify data or code without authorization?

   • ATampering
   • BSpoofing
   • CInformation Disclosure
   • DRepudiation
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security team is reviewing a vulnerability that was disclosed two weeks ago. The vendor has released a patch, but the team is unsure whether to prioritize it over other pending patches. Which information would most help the team decide?

   • AThe number of systems affected in the organization.
   • BThe CVSS score of the vulnerability.
   • CThe time since the vulnerability was disclosed.
   • DThreat intelligence reports showing active exploitation of this vulnerability in the organization's industry.
   Reveal Solution Discussion Select an answer first
3. 48application · medium

   A company wants to ensure that newly disclosed vulnerabilities are quickly identified and assessed for relevance to their environment. Which process would best support this goal?

   • ARun a full vulnerability scan once a year.
   • BRely on the IT helpdesk to report any security issues they notice.
   • CWait for the next penetration test to identify new vulnerabilities.
   • DSubscribe to vendor security advisories and use a vulnerability management platform that ingests them automatically.
   Reveal Solution Discussion Select an answer first