Explain How Security Controls Are Continually Tested and Gaps Are Remediated. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which testing methodology is typically automated and used to identify known vulnerabilities, such as missing patches or misconfigurations, across a large number of systems?

   • ASecurity assessment
   • BRed teaming
   • CPenetration testing
   • DVulnerability scanning
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does a gap in a security control expose an organization to risk?

   • AIt guarantees that a data breach will occur within a specific timeframe
   • BIt creates a potential path for an attacker to exploit, increasing the likelihood of a security incident
   • CIt automatically disables all other security controls in the environment
   • DIt has no impact unless the gap is publicly disclosed
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of continuously testing security controls rather than testing them only once during implementation?

   • ATo guarantee that no security breach will ever occur in the future
   • BTo eliminate the need for security monitoring and incident response activities
   • CTo satisfy regulatory requirements that mandate daily testing of all security controls
   • DTo ensure controls remain effective as threats, systems, and configurations evolve over time
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team has a mature testing program that includes quarterly vulnerability scans and annual penetration tests. After a recent incident, they realized that a new attack technique was not detected by their controls. They want to improve their program to catch such techniques earlier. Which approach best aligns with continuous improvement?

   • AFocus on remediating the specific gap from the incident and do not change the testing schedule.
   • BIncrease the frequency of vulnerability scans to monthly and add a red team exercise annually.
   • CReplace all vulnerability scans with continuous automated penetration testing.
   • DWait for the next annual penetration test to see if the new technique is detected.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team needs to evaluate the effectiveness of their web application firewall (WAF) against a range of common attack patterns, including SQL injection and cross-site scripting. They want a quick, repeatable test that can be run regularly without requiring manual effort. Which methodology is most suitable?

   • AManual penetration testing
   • BCompliance audit
   • CAutomated vulnerability scanning
   • DFull-scope red teaming
   Reveal Solution Discussion Select an answer first