Vulnerability and Threat Management GCIL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A vulnerability scan reveals a critical vulnerability on an internet-facing web server and a high vulnerability on an internal file server. The web server is protected by a web application firewall (WAF), while the internal file server has no compensating controls. Which vulnerability should be remediated first?

   • AThe internet-facing web server vulnerability, because it has a higher severity rating.
   • BThe internal file server vulnerability, because it has no compensating controls and is more easily exploitable.
   • CNeither, because the scan results are not reliable.
   • DBoth at the same time, because both are serious.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company has a hybrid environment with on-premises industrial control systems and cloud-hosted business applications. The security team currently runs quarterly vulnerability scans of the IT environment but does not scan the OT environment. The incident leader wants to establish continuous monitoring for new vulnerabilities across both environments. Which approach should the incident leader recommend?

   • AImplement a passive network monitoring solution for the OT environment and maintain the quarterly active scans for IT, supplemented by weekly IT scans.
   • BContinue quarterly scans for both environments and rely on vendor security advisories to identify new vulnerabilities.
   • CDeploy an agent-based vulnerability scanner on all OT assets and configure it to scan every hour.
   • DRun an active authenticated scan of the OT environment once per month during a maintenance window.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which tool is specifically designed to identify known vulnerabilities in network services by comparing service banners and responses against a database of Common Vulnerabilities and Exposures (CVEs)?

   • AWireshark
   • BMetasploit
   • CNessus
   • DNmap
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A vulnerability assessment found a remote code execution vulnerability in a widely used application. The vulnerability is not yet publicly disclosed, but the security team learned about it through a private threat intelligence channel. The vendor has not released a patch. What should the team do?

   • AIgnore the vulnerability until the vendor releases a patch.
   • BPublicly disclose the vulnerability to warn other organizations.
   • CAssess the exposure of the application in the environment and implement temporary mitigations such as network restrictions.
   • DDevelop an unofficial patch and deploy it immediately.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A critical vulnerability is found in a legacy application that cannot be patched because the vendor is out of business. The application is used by the finance department and is connected to the corporate network. The company cannot afford to replace the application for six months. Which remediation plan best reduces risk in the interim?

   • AAsk the finance department to avoid using the application until it is replaced.
   • BPlace the application on the internet to make it easier to monitor.
   • CIsolate the application on a separate network segment with strict firewall rules and limit access to only finance users.
   • DDisconnect the application from the network and have finance use a different process.
   Reveal Solution Discussion Select an answer first