Explain How Security Controls Are Continually Tested and Gaps Are Remediated. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a penetration test, the testers successfully exploited a misconfigured firewall rule to access an internal database containing customer PII. The firewall rule was intended to allow only specific IP addresses, but it was left open to the internet. What is the most significant risk exposure resulting from this gap?

   • AThe database will be automatically patched by the vendor.
   • BIncreased network latency due to unnecessary open ports.
   • CThe firewall will be unable to log traffic, reducing audit capability.
   • DUnauthorized access to sensitive data, leading to potential data breach and regulatory penalties.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team has identified a gap in their access control system: a former employee's account is still active. The account has administrative privileges. The team is unsure if the account was used after the employee left. What is the most appropriate immediate action?

   • AInvestigate the account activity first to understand the impact before taking action.
   • BChange the account password and leave it enabled.
   • CNotify the former employee and ask them to confirm they no longer need access.
   • DDisable the account immediately and then investigate any activity.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A vulnerability scan identified that a server is missing a critical security patch. The server is not exposed to the internet and is only accessible from the internal network. However, the scan also found that the server has a default administrative password. What is the most significant risk?

   • AThe server will fail a compliance audit.
   • BAn internal attacker could use the default password to gain administrative access.
   • CThe server will be automatically decommissioned.
   • DThe missing patch could be exploited remotely from the internet.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration test revealed that an internal application allows users to access other users' data by modifying a URL parameter. The application is used by employees and contains HR records. What is the most appropriate first step in addressing this gap?

   • AIgnore the finding because it is an internal application.
   • BImmediately shut down the application to prevent further access.
   • CDocument the finding and assess the risk to determine priority.
   • DNotify all employees that the application is vulnerable.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team has identified a critical vulnerability in a customer-facing application. The fix requires a database schema change that will cause 30 minutes of downtime. The application is used by customers during business hours. The team has a change window available at 2 AM. What is the most important consideration when planning the remediation?

   • ADelay the fix until the next scheduled maintenance window, which is in three months.
   • BApply the fix immediately, even during business hours, because the vulnerability is critical.
   • CApply the fix without testing to save time.
   • DSchedule the fix during the 2 AM change window to minimize business impact.
   Reveal Solution Discussion Select an answer first