Exploitation & Mitigation GFACT Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security architect is designing a mitigation strategy for a critical application that cannot be taken offline for patching. The application has a known remote code execution vulnerability. The architect must balance the need to protect the application with the requirement to maintain availability. Which approach best meets these conflicting requirements?

   • ATake the application offline immediately to apply the patch, accepting the downtime.
   • BMonitor the application closely and only patch if an attack is detected.
   • CDeploy a web application firewall (WAF) with virtual patching and implement network segmentation to limit the impact of a potential breach.
   • DDisable the vulnerable feature in the application configuration.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A system administrator discovers that a service running on a server has a known vulnerability that allows a local user to gain root privileges. The administrator needs to mitigate this risk quickly. Which action is most appropriate?

   • AIncrease the service's logging level
   • BDisable the local user accounts
   • CChange the service's port number
   • DApply the vendor's security patch
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of privilege escalation?

   • ATo maintain persistent access to the system
   • BTo gain higher-level access rights than originally obtained
   • CTo move laterally across the network
   • DTo hide malicious activity from security tools
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which mitigation strategy is most effective in limiting the damage an attacker can do if they compromise a low-privileged user account?

   • ADisabling the firewall
   • BMonitoring network traffic
   • CImplementing the principle of least privilege
   • DUsing a strong encryption algorithm
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is implementing a security monitoring solution. They want to detect exploitation attempts and also have the ability to block malicious traffic in real time. However, they are concerned about the operational impact of false positives. Which solution best balances detection and prevention while minimizing disruption?

   • AFirewall with default deny all traffic
   • BHost-based intrusion prevention system (HIPS) with default block mode
   • CNetwork intrusion prevention system (IPS) in alert mode initially, then enable blocking after tuning
   • DNetwork intrusion detection system (IDS) with alerts
   Reveal Solution Discussion Select an answer first