Discovery and Vulnerability Scanning GMON Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team has a vulnerability management program with a remediation SLA of 30 days for critical vulnerabilities. A scan found a critical vulnerability on a legacy system that cannot be patched because the vendor no longer provides updates. The system is internet-facing and handles sensitive data. What should the team do?

   • ADocument the risk and accept it because the system cannot be patched.
   • BPlace the system behind a firewall and restrict access to reduce exposure.
   • CImplement compensating controls, such as a WAF and network segmentation, and document the risk acceptance.
   • DDecommission the system immediately to eliminate the risk.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A vulnerability scan of a hospital network reveals the following findings: (1) a critical remote code execution vulnerability on a medical device that is directly connected to the patient monitoring network, (2) a high-severity vulnerability on a public-facing web server that is not yet exploited, and (3) a medium-severity vulnerability on an internal file server that contains sensitive patient records. The hospital has limited patching resources and must prioritize remediation. Which vulnerability should be patched first?

   • AThe high-severity vulnerability on the public-facing web server, because it is internet-facing and more likely to be exploited.
   • BThe medium-severity vulnerability on the internal file server, because it contains sensitive patient records.
   • CPatch all three vulnerabilities simultaneously, because all are important and delaying any of them increases risk.
   • DThe critical vulnerability on the medical device, because it is directly connected to patient safety systems and has high exploitability.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A vulnerability scan of a web server reports a critical vulnerability in Apache Struts. The analyst checks the server and finds that the Struts library is not present in the application's dependency list, but the scan still flags it. What should the analyst do first?

   • AIncrease the scan frequency to catch the vulnerability more quickly next time.
   • BMark the finding as a false positive in the scanner and move on to other vulnerabilities.
   • CImmediately patch the server with the latest Apache Struts update.
   • DVerify whether the vulnerable library is actually installed by checking the server's file system and running application.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why might an organization schedule vulnerability scans during off-peak hours?

   • ATo ensure that all systems are powered off during the scan
   • BTo comply with a legal requirement that scans only happen at night
   • CTo reduce the potential impact on production systems and network performance
   • DTo prevent the scanner from being detected by security monitoring
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is asked to scan a network segment that includes systems owned by a partner organization. The partner has not signed a scanning authorization. What should the analyst do?

   • AScan the partner systems but only with a low-intensity scan to minimize impact.
   • BExclude the partner systems from the scan until written authorization is obtained.
   • CAsk the partner for verbal approval and proceed with the scan.
   • DScan only the partner systems that are critical to the business.
   Reveal Solution Discussion Select an answer first