Discovery and Vulnerability Scanning GMON Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A vulnerability scan identified a critical vulnerability on a server that is scheduled for decommissioning in two weeks. The server is not internet-facing and has no active users. The security team has limited resources. What should the team do?

   • AIsolate the server from the network to prevent exploitation.
   • BDecommission the server immediately to eliminate the risk.
   • CPatch the server immediately because it is critical.
   • DDocument the finding and accept the risk for the short remaining lifespan.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A vulnerability scan reports that a web server is running Apache 2.4.41, which has a known critical vulnerability. The server team confirms the binary version is 2.4.41, but they have applied a vendor backport patch that mitigates the vulnerability. How should the security analyst classify this finding?

   • AInformational finding, because the version is outdated but not exploitable.
   • BFalse positive, because the vendor backport patch mitigates the vulnerability.
   • CTrue positive, but with a lower severity due to the backport patch.
   • DTrue positive, because the version number matches the vulnerable version.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company's vulnerability scanner identified a new host on the network that is not in the CMDB. The host is running an outdated operating system with known critical vulnerabilities. The security team needs to integrate this finding into the configuration management process. What should be the first step?

   • ARun a full vulnerability scan on the host and patch all vulnerabilities before adding it to the CMDB.
   • BAdd the host to the CMDB with a placeholder owner and schedule a vulnerability scan for it.
   • CIdentify the host's owner and purpose, then add it to the CMDB with accurate metadata.
   • DIsolate the host from the network immediately to prevent exploitation.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team must schedule vulnerability scans for a network that includes a production environment and a development environment. The production environment is highly critical and changes frequently, while the development environment is less critical and changes rarely. The team has limited scanning resources and must avoid impacting production during business hours. What is the best scanning strategy?

   • AScan both environments weekly during business hours to ensure timely detection.
   • BScan production monthly and development weekly, because development is more likely to have vulnerabilities.
   • CScan production weekly during a maintenance window and development monthly during off-hours.
   • DScan both environments monthly during off-hours to balance coverage and resource use.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How can discovery scanning results be used to improve configuration management?

   • ABy automatically applying configuration baselines to all discovered hosts
   • BBy generating compliance reports that are automatically accepted by all auditors
   • CBy replacing the need for any manual asset inventory processes
   • DBy providing an up-to-date list of active hosts and services that can be compared against the configuration management database (CMDB)
   Reveal Solution Discussion Select an answer first