Discovery and Vulnerability Scanning GMON Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a compliance requirement to scan all internet-facing systems quarterly, but the security team wants to scan them monthly to reduce risk. The company also has a change-management policy that requires all scans to be approved by the CAB, and the CAB only meets monthly. What is the most appropriate scanning frequency?

   • AScan quarterly, but use a passive scanner to avoid the need for CAB approval.
   • BScan quarterly, because that is the compliance requirement and the CAB only meets monthly.
   • CScan monthly, with a standing approval from the CAB for the recurring scan.
   • DScan monthly without CAB approval because the scans are low-impact.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key limitation of unauthenticated vulnerability scanning?

   • AIt cannot identify open ports on any system
   • BIt always causes systems to crash
   • CIt is too slow to be used in any production environment
   • DIt cannot detect vulnerabilities that require valid credentials to see, such as missing patches on authenticated services
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a compliance requirement to scan all assets quarterly, but a recent audit found that some assets were not scanned for six months. The security team has limited scanning capacity and must ensure compliance while also addressing a critical vulnerability that was found on a public-facing server. What should the team do?

   • ARun a full scan of all assets immediately, and patch the critical vulnerability as soon as the scan completes.
   • BRun a full scan of all assets immediately to meet compliance, then patch the critical vulnerability.
   • CPatch the critical vulnerability first, then run a full scan of all assets to meet compliance.
   • DRun a targeted scan of the public-facing server and patch the critical vulnerability, then schedule a full scan for the next quarter.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's vulnerability scan identified a critical vulnerability on a server that is listed in the CMDB as a test server, but the server is actually used in production. The remediation team is about to patch the server, but the change-management process requires a 30-day lead time. What is the most appropriate action?

   • AUpdate the CMDB to reflect the server's production role, and initiate an expedited change request for the patch.
   • BPatch the server immediately without a change request because it is a critical vulnerability.
   • CWait the full 30 days for the change request, because the CMDB says it is a test server.
   • DRemove the server from the CMDB because the classification is incorrect.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's discovery scan identified a new server on the network that is not in the configuration management database (CMDB). The server is running a legacy application that is no longer supported. What should the security team do first?

   • AIgnore the server because it was not in the CMDB and therefore is not an official asset.
   • BRun a vulnerability scan on the server to determine if it is exploitable before adding it to the CMDB.
   • CAdd the server to the CMDB with its discovered details and flag it for review.
   • DImmediately disconnect the server from the network because it is running unsupported software.
   Reveal Solution Discussion Select an answer first