System Hardening CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security tester is verifying that a newly hardened server is compliant with the organization's security baseline. The tester runs a compliance scan and receives a report showing that 98% of the checks passed. The tester needs to determine whether the 2% that failed are significant. Which action should the tester take FIRST?

   • AReview the specific failed checks to understand the risk they pose and whether they are false positives
   • BImmediately remediate all failed checks without further analysis
   • CAccept the 98% pass rate as sufficient because the server is mostly compliant
   • DRe-run the scan multiple times to confirm the results are consistent
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security tester is evaluating a server that hosts a legacy application. The application requires an old version of a library that has a known critical vulnerability. The vendor no longer provides patches for this library, and the application cannot be updated without a major rewrite. The tester must recommend a course of action. Which recommendation BEST balances security and business continuity?

   • AImmediately take the server offline until the application can be rewritten
   • BIgnore the vulnerability because the application is legacy and the risk is accepted by management
   • CApply compensating controls such as network segmentation and strict access controls to reduce the exploitability of the vulnerable library
   • DReplace the vulnerable library with a newer version and hope the application still works
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security tester is assessing a web application server that is behind a load balancer. The server has a critical vulnerability in the web server software, but the load balancer is configured to block all traffic to the vulnerable endpoint. The tester must decide whether to prioritize patching this vulnerability. Which consideration is MOST important in this decision?

   • AThe tester should immediately take the server offline to patch it, regardless of the load balancer configuration
   • BThe tester should ignore the vulnerability because the load balancer fully mitigates it and no further action is needed
   • CThe vulnerability must be patched immediately because any known vulnerability is a critical risk regardless of compensating controls
   • DThe vulnerability is not directly exploitable because the load balancer blocks the endpoint, so patching can be scheduled during the next regular maintenance window
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a common system hardening technique that involves disabling or removing software components that are not needed for the system's intended function?

   • ANetwork segmentation
   • BConfiguration baselines
   • CService minimization
   • DPatch management
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security tester is evaluating a newly deployed database server. The server has a default configuration, and the tester wants to verify that service minimization has been applied. Which finding would indicate that service minimization was NOT correctly implemented?

   • AThe server has a host-based firewall enabled with a default-deny policy
   • BThe server is running a web server on port 8080 that is not required by the database application
   • CThe database service is configured to listen only on the internal management network
   • DThe latest database security patches have been applied to the server
   Reveal Solution Discussion Select an answer first