Discovery and Vulnerability Scanning GMON Practice Questions (Page 9)

Questions 41–44

1. 41foundation · easy

   What is a false positive in the context of vulnerability scanning?

   • AA finding that reports a vulnerability that does not actually exist on the scanned system
   • BA vulnerability that is real but has no known exploit
   • CA finding that is informational and requires no action
   • DA vulnerability that was fixed but the scanner still reports it
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A vulnerability scan of a database server reports a critical finding for CVE-2023-1234, but the analyst knows the database is not internet-facing and the vulnerability requires local access. The database is classified as a high-value asset. How should the analyst handle this finding?

   • AIgnore the finding because the database is a high-value asset and the scan may be inaccurate.
   • BEscalate the finding to the database team immediately without further analysis.
   • CMark it as a false positive because the database is not internet-facing.
   • DTreat it as a true positive but adjust the priority based on the reduced exploitability.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is a common open-source tool used for both discovery and vulnerability scanning?

   • AMicrosoft Defender for Cloud
   • BWireshark
   • CSplunk
   • DNmap
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   How should an analyst typically treat an informational finding in a vulnerability scan report?

   • AAs a non-critical observation that may describe system details but does not indicate a known vulnerability
   • BAs a sign that the scanner is malfunctioning
   • CAs a false positive that should be ignored completely
   • DAs a critical vulnerability that must be patched immediately
   Reveal Solution Discussion Select an answer first