Discovery and Vulnerability Scanning GMON Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team runs a vulnerability scan on a new application server and finds several high-severity vulnerabilities. The team wants to confirm which findings are actually exploitable before sending them to the remediation team. What is the most appropriate next step?

   • AIncrease the scan frequency to catch the vulnerabilities more often.
   • BPerform manual verification of the findings, such as checking the application version and configuration.
   • CSend all high-severity findings directly to the remediation team for immediate patching.
   • DRe-run the scan with a different scanner to see if it reports the same findings.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team needs to discover all active hosts on a large, segmented network. They have been given authorization to scan all segments, but they want to minimize the time and network impact of the discovery phase. Which technique is most appropriate for this task?

   • ARun a full TCP port scan on every possible port for every IP address in the range.
   • BPerform a ping sweep across all segments using ICMP echo requests.
   • CUse ARP scans on each subnet to identify active hosts.
   • DQuery the DNS server for all host records in the domain.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A vulnerability scan found a critical vulnerability on a server that is listed in the CMDB as 'owner unknown'. The server is used by multiple departments. The security team needs to remediate the vulnerability. What should be the first step?

   • AIsolate the server from the network to prevent exploitation.
   • BDecommission the server because it has no owner.
   • CIdentify the owner and update the CMDB before patching.
   • DPatch the server immediately because it is critical.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst at a financial firm is asked to improve the discovery scanning program. The firm has a strict change-management policy that requires all active scans to be approved by the change advisory board (CAB) at least 72 hours in advance. The analyst wants to run a full discovery scan of the internal network every Friday night to catch new assets added during the week. Which approach best balances the firm's change-management requirement with the need for timely asset discovery?

   • ASubmit a standing request to the CAB for a recurring Friday-night scan, and run the scan automatically each week.
   • BRun the scan on Monday morning instead, because the CAB is more likely to approve a scan at the start of the business week.
   • CUse a passive discovery technique such as NetFlow analysis to avoid the need for CAB approval.
   • DRun the scan on Friday night without CAB approval because discovery scans are passive and do not affect production systems.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary reason to obtain written authorization before conducting a vulnerability scan?

   • ATo make the scan results automatically compliant with all regulations
   • BTo avoid legal liability and ensure the scan is considered a legitimate security activity
   • CTo guarantee that the scan will not cause any system downtime
   • DTo allow the scanner to bypass all security controls
   Reveal Solution Discussion Select an answer first