Vulnerability and Threat Management GCIL Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization is migrating a legacy application to the cloud. The security team wants to identify potential threats introduced by the new architecture, such as misconfigured storage and excessive permissions. Which threat modeling approach would be most effective?

   • AUse a cloud-specific threat modeling framework that considers shared responsibility and cloud service models.
   • BApply the same on-premises threat model without changes.
   • CConduct a vulnerability scan after deployment and fix any findings.
   • DSkip threat modeling and rely on the cloud provider's security features.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team is planning a vulnerability scan of a large enterprise network that includes both critical production systems and low-priority development environments. The scan must not cause any downtime. Which scanning strategy best balances coverage and risk?

   • ARun the scan during business hours to have staff available to respond to issues.
   • BScan only the development environment to avoid any risk to production.
   • CUse the same aggressive scan settings for all systems to ensure consistency.
   • DUse credentialed scans with safe checks on production systems and more aggressive scans on development systems.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a key characteristic of an effective vulnerability report for technical stakeholders?

   • AIt focuses only on high-level business impact
   • BIt includes actionable remediation steps and affected systems
   • CIt lists only the vulnerabilities that have patches
   • DIt omits CVSS scores to avoid confusion
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which factor is most important when prioritizing which vulnerability to remediate first?

   • AThe ease of exploitation
   • BThe age of the vulnerability
   • CThe number of systems affected
   • DThe business impact of the affected asset
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A mid-sized company has completed a vulnerability assessment and identified 200 findings. The incident leader must communicate the results to the IT operations team, which is responsible for patching. The team has limited capacity and needs clear guidance on what to fix first. Which communication approach would best support the IT operations team?

   • AProvide a prioritized remediation list that groups findings by severity, affected system, and recommended patch or mitigation.
   • BSend the raw scan report and ask the team to determine the priority themselves.
   • CPresent a high-level summary to the IT team without technical details, focusing only on business risk.
   • DCommunicate only the critical findings and omit all other findings to reduce the team's workload.
   Reveal Solution Discussion Select an answer first