Triage and Remediate Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A vulnerability scanner reports a medium-severity finding in a company's internal file server. The finding indicates that the server is running an outdated version of a file-sharing protocol that could allow information disclosure. The server is only accessible to authenticated employees and contains non-confidential project files. What should the security analyst do during triage?

   • AImmediately take the server offline to prevent any potential information disclosure.
   • BDocument the finding, note the mitigating factors, and schedule an upgrade during the next maintenance window.
   • CIgnore the finding because the server is internal and the data is not confidential.
   • DEscalate the finding to the incident response team as a critical security incident.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is documentation of vulnerability triage decisions important for audit and compliance?

   • AIt prevents all future vulnerabilities from occurring.
   • BIt automatically patches the vulnerability.
   • CIt provides evidence that vulnerabilities were assessed and handled appropriately.
   • DIt increases the CVSS score of the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What does the CVSS base score primarily measure?

   • AThe availability of a patch from the software vendor.
   • BThe number of systems in an organization that are affected by the vulnerability.
   • CThe inherent characteristics of a vulnerability, such as attack vector and impact.
   • DThe likelihood that a specific organization will be targeted by attackers.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team remediated a SQL injection vulnerability in a web application by adding input validation. After the fix, the team re-ran the vulnerability scanner and the finding was no longer reported. However, a penetration tester later found that the input validation could be bypassed with a specific encoding technique. What should the team do?

   • AAccept the risk because the bypass requires a specific encoding technique.
   • BUpdate the scanner configuration to detect the encoding technique and re-scan.
   • CClose the finding because the scanner no longer reports it.
   • DRe-open the finding, document the bypass, and implement a more robust remediation such as parameterized queries.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's web application has a vulnerability that allows an attacker to upload malicious files. The application is critical to business operations, and the team cannot take it offline for patching. Which remediation strategy should the team apply?

   • AImplement file type and content validation on the upload endpoint.
   • BDisable the file upload feature entirely.
   • CApply the vendor patch during business hours, accepting the downtime.
   • DMove the application to a different server to avoid the vulnerability.
   Reveal Solution Discussion Select an answer first