Network Scanning and Vulnerability Detection GOAA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration tester is scanning a target and finds an open port 443. The tester runs nmap -sV and gets the following output: '443/tcp open ssl/http Apache httpd 2.4.49'. The tester knows that Apache 2.4.49 has a critical RCE vulnerability. However, the tester also notices that the server may be behind a load balancer. What is the most important next step?

   • AImmediately exploit the RCE vulnerability because the version is confirmed.
   • BVerify the actual server version by sending a direct request to the backend server, bypassing the load balancer.
   • CReport the vulnerability as confirmed because the banner shows the exact version.
   • DRun a full port scan to find other services before exploiting.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center (SOC) wants to automate the triage of vulnerability scan results from multiple scanners. The SOC receives thousands of findings daily and needs to reduce the time analysts spend on false positives. Which AI technique would be most effective for this task?

   • AUse a reinforcement learning agent that learns to prioritize findings based on analyst feedback.
   • BUse a natural language processing model to read vulnerability descriptions and assign severity scores.
   • CUse a supervised machine learning model trained on labeled historical scan data to classify findings as true or false positives.
   • DUse a clustering algorithm to group similar findings and have analysts review one from each cluster.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is scanning an internal network with a vulnerability scanner. The scanner reports a critical vulnerability in Apache Struts on a web server, but the tester knows the server is actually running a patched version. Which action should the tester take first?

   • AIgnore the finding because the scanner is always wrong about version detection.
   • BVerify the service version manually and confirm whether the vulnerability applies.
   • CImmediately report the critical vulnerability to the client as a confirmed finding.
   • DRe-run the scan with a different scanner to see if it agrees.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is using a vulnerability scanner that relies on a database of known vulnerabilities. The scanner is producing a high number of false positives because it is flagging services that have already been patched. The team wants to reduce false positives without missing real vulnerabilities. Which approach should the team take?

   • AUse a different scanner that only checks for critical vulnerabilities.
   • BIncrease the scanner's sensitivity to catch more potential vulnerabilities.
   • CUse an AI-enhanced scanner that learns from the organization's patch history to filter out patched services.
   • DDisable the vulnerability database and rely on manual testing.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is using a vulnerability scanner that relies on a plugin database. The scanner reports a critical vulnerability in a custom web application, but the team cannot find any CVE for it. The scanner's plugin may be using heuristic detection. What is the best course of action?

   • AIgnore the finding because there is no CVE.
   • BManually test the custom application to confirm the vulnerability.
   • CReport the finding as a zero-day vulnerability.
   • DUpdate the scanner's plugin database and re-scan.
   Reveal Solution Discussion Select an answer first