Vulnerability and Threat Management GCIL Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm is expanding its cloud infrastructure and has added 50 new virtual machines in a new subnet. The security team's vulnerability scanner is configured to scan the existing subnets. The incident leader is responsible for ensuring the new assets are included in the vulnerability management program. Which action should the incident leader take first?

   • AWait for the next quarterly scan cycle to include the new subnet automatically.
   • BAdd the new subnet to the scanner's scope and schedule an authenticated scan using the appropriate credentials for the new VMs.
   • CUpdate the scanner's asset discovery settings to include the new subnet and run an unauthenticated scan immediately.
   • DManually review the security group rules for the new subnet and assume that properly configured rules eliminate the need for scanning.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which threat intelligence source provides real-time indicators of compromise (IOCs) such as malicious IP addresses, domains, and file hashes?

   • ACVE database
   • BVulnerability scanner plugin database
   • COpen-source intelligence (OSINT) feeds
   • DCVSS calculator
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A retail company's security team has identified three vulnerabilities in its environment: (1) a critical remote code execution vulnerability in an internet-facing web server that is not currently exploited in the wild, (2) a high-severity vulnerability in an internal file server that is being actively exploited by a known threat group, and (3) a medium-severity vulnerability in a non-critical internal application. The team has limited resources and can remediate only one vulnerability this week. Which vulnerability should be prioritized?

   • AThe critical RCE vulnerability on the internet-facing web server because it has the highest CVSS score.
   • BAll three vulnerabilities equally because they all require remediation.
   • CThe high-severity vulnerability on the internal file server because it is actively exploited by a known threat group.
   • DThe medium-severity vulnerability on the non-critical internal application because it is the easiest to remediate.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization's security team runs weekly authenticated vulnerability scans across its environment. The team receives daily threat intelligence feeds from a commercial provider, open-source intelligence sources, and a sector-specific Information Sharing and Analysis Organization. The incident leader wants to improve the relevance of the weekly scan report by correlating scan results with the intelligence feeds. Which action would most effectively achieve this goal?

   • ACreate a weekly report that overlays scan findings with intelligence indicators of compromise and known exploited vulnerability lists, flagging matches for immediate review.
   • BConfigure the vulnerability scanner to automatically suppress any finding that does not appear in the current threat intelligence feeds.
   • CIncrease scan frequency to daily so that the scan results are as current as the intelligence feeds.
   • DReplace the commercial threat intelligence feed with the open-source feeds to reduce costs and simplify the correlation process.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the main purpose of continuous monitoring in vulnerability management?

   • ATo detect new vulnerabilities and emerging threats as they arise
   • BTo eliminate the need for vulnerability assessments
   • CTo provide a one-time snapshot of the security posture
   • DTo replace the need for incident response
   Reveal Solution Discussion Select an answer first