Exploit Methodology and Analysis GMON Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A vulnerability scanner reports a critical vulnerability in a custom application. The scanner provides a CVSS score but no exploit code. The team needs to determine the actual risk to the organization. Which action is most appropriate?

   • AConduct a manual penetration test to validate the vulnerability's exploitability.
   • BImmediately patch the application without further analysis.
   • CRely solely on the CVSS score to prioritize remediation.
   • DIgnore the vulnerability because no exploit code is publicly available.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of applying security patches to software?

   • ATo increase the speed of the software
   • BTo improve the user interface of the software
   • CTo remediate known vulnerabilities that could be exploited
   • DTo detect when an exploit has been attempted
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team is reviewing a series of alerts that show an attacker first performed a port scan, then exploited a vulnerability in a database service, and finally used the compromised database server to access other systems on the network. Which stage of the exploit lifecycle does the final action represent?

   • AVulnerability discovery
   • BExploit development
   • CPost-exploitation
   • DLateral movement
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In vulnerability analysis, what is the primary purpose of a Common Vulnerability Scoring System (CVSS) score?

   • ATo identify the specific exploit code that can be used against a vulnerability
   • BTo list all affected software versions
   • CTo provide a standardized measure of the severity of a vulnerability
   • DTo automatically patch the vulnerability
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security engineer is reviewing a vulnerability scan and finds that a web application is vulnerable to cross-site scripting (XSS). The application is scheduled to be replaced in six months. Which mitigation should the engineer implement to reduce the risk in the interim?

   • ADisable JavaScript in all users' browsers.
   • BAdd a WAF rule to filter out malicious script payloads.
   • CRemove the vulnerable application from the network immediately.
   • DIncrease the logging level on the web server.
   Reveal Solution Discussion Select an answer first