Chapter 2
Domain 2.0: Vulnerability Management

  1. During the reconnaissance stage of a penetration test, Cynthia needs to gather information about the target organization's network infrastructure without causing an IPS to alert the target to her information gathering. Which of the following is her best option?
    1. Perform a DNS brute-force attack.
    2. Use an Nmap ping sweep.
    3. Perform a DNS zone transfer.
    4. Use an Nmap stealth scan.
  2. A port scan of a remote system shows that port 3306 is open on a remote database server. What database is the server most likely running?
    1. Oracle
    2. Postgres
    3. MySQL
    4. Microsoft SQL
  3. During a port scan of her network, Cynthia discovers a workstation that shows the following ports open. What should her next action be?
    A window page presents an output.
    1. Determine the reason for the ports being open.
    2. Investigate the potentially compromised workstation.
    3. Run a vulnerability scan to identify vulnerable services.
    4. Reenable the workstation's local host firewall.
  4. Which one of the following threats is the most pervasive in modern computing environments?
    1. Zero-day attacks
    2. Advanced persistent threats
    3. Malware
    4. Insider threats
  5. Nara is concerned about the risk of attackers conducting a brute-force attack against her organization. Which one of the following factors is Nara most likely to be able to control?
    1. Attack vector
    2. Adversary capability
    3. Likelihood
    4. Total attack surface
  6. What is the default Nmap scan type when Nmap is not provided with a scan type flag?
    1. A TCP FIN scan
    2. A TCP connect scan
    3. A TCP SYN scan
    4. A UDP scan
  7. Lakshman wants to limit what potential attackers can gather during passive or semipassive reconnaissance activities. Which of the following actions will typically most reduce his organization's footprint?
    1. Limit information available via the organizational website without authentication.
    2. Use a secure domain registration.
    3. Limit technology references in job postings.
    4. Purge all document metadata before posting.
  8. Cassandra's Nmap scan of an open wireless network (192.168.10/24) shows the following host at IP address 192.168.1.1. Which of the following is most likely to be the type of system at that IP address based on the scan results shown?
    A window page presents an output.
    1. A virtual machine
    2. A wireless router
    3. A broadband router
    4. A print server
  9. Several organizations recently experienced security incidents when their AWS secret keys were published in public GitHub repositories. What is the most significant threat that could arise from this improper key management?
    1. Total loss of confidentiality
    2. Total loss of integrity
    3. Total loss of availability
    4. Total loss of confidentiality, integrity, and availability
  10. After Kristen received a copy of an Nmap scan run by a penetration tester that her company hired, she knows that the tester used the -O flag. What type of information should she expect to see included in the output other than open ports?
    1. OCMP status
    2. Other ports
    3. Objective port assessment data in verbose mode
    4. Operating system and Common Platform Enumeration (CPE) data
  11. Andrea wants to conduct a passive footprinting exercise against a target company. Which of the following techniques is not suited to a passive footprinting process?
    1. WHOIS lookups
    2. Banner grabbing
    3. BGP looking glass usage
    4. Registrar checks
  12. Alex wants to scan a protected network and has gained access to a system that can communicate to both his scanning system and the internal network, as shown in the image here. What type of Nmap scan should Alex conduct to leverage this host if he cannot install Nmap on system A?
    An illustration of a protected network.
    1. A reflection scan
    2. A proxy scan
    3. A randomized host scan
    4. A ping-through scan
  13. Maddox is conducting an inventory of access permissions on cloud-based object buckets, such as those provided by the AWS S3 service. What threat is he seeking to mitigate?
    1. Insecure APIs
    2. Improper key management
    3. Unprotected storage
    4. Insufficient logging and monitoring
  14. Alex has been asked to assess the likelihood of reconnaissance activities against her organization (a small, regional business). Her first assignment is to determine the likelihood of port scans against systems in her organization's screened subnet (otherwise known as a DMZ). How should she rate the likelihood of this occurring?
    1. Low.
    2. Medium.
    3. High.
    4. There is not enough information for Alex to provide a rating.
  15. Lucy recently detected a cross-site scripting (XSS) vulnerability in her organization's web server. The organization operates a support forum where users can enter HTML tags and the resulting code is displayed to other site visitors. What type of cross-site scripting vulnerability did Lucy discover?
    1. Persistent
    2. Reflected
    3. DOM-based
    4. Blind
  16. Florian discovered a vulnerability in a proprietary application developed by his organization. The application has a flaw that allows users to log into the system by providing a valid username and leaving the password blank. What term best describes this overflow?
    1. Directory traversal
    2. Stack overflow
    3. Injection flaw
    4. Broken access control
  17. The company that Dan works for has recently migrated to an SaaS provider for its enterprise resource planning (ERP) software. In its traditional on-site ERP environment, Dan conducted regular port scans to help with security validation for the systems. What will Dan most likely have to do in this new environment?
    1. Use a different scanning tool.
    2. Rely on vendor testing and audits.
    3. Engage a third-party tester.
    4. Use a VPN to scan inside the vendor's security perimeter.
  18. Which one of the following languages is least susceptible to an injection attack?
    1. HTML
    2. SQL
    3. STIX
    4. XML
  19. Which one of the following types of malware would be most useful in a privilege escalation attack?
    1. Rootkit
    2. Worm
    3. Virus
    4. RAT
  20. Abdul is conducting a security audit of a multicloud computing environment that incorporates resources from AWS and Microsoft Azure. Which one of the following tools will be least useful to him?
    1. ScoutSuite
    2. Pacu
    3. Prowler
    4. CloudSploit
  21. Greg is concerned about the use of DDoS attack tools against his organization, so he purchased a mitigation service from his ISP. What portion of the threat model did Greg reduce?
    1. Likelihood
    2. Total attack surface
    3. Impact
    4. Adversary capability
  22. Carrie needs to lock down a Windows workstation that has recently been scanned using Nmap with the results shown here. She knows that the workstation needs to access websites and that the system is part of a Windows domain. What ports should she allow through the system's firewall for externally initiated connections?
    A window page presents an output.
    1. 80, 135, 139, and 445.
    2. 80, 445, and 3389.
    3. 135, 139, and 445.
    4. No ports should be open.
  23. Adam's port scan returns results on six TCP ports: 22, 80, 443, 515, 631, and 9100. If Adam needs to guess what type of device this is based on these ports, what is his best guess?
    1. A web server
    2. An FTP server
    3. A printer
    4. A proxy server
  24. In his role as the SOC operator, Manish regularly scans a variety of servers in his organization. After two months of reporting multiple vulnerabilities on a Windows file server, Manish recently escalated the issue to the server administrator's manager.

    At the next weekly scan window, Manish noticed that all the vulnerabilities were no longer active; however, ports 137, 139, and 445 were still showing as open. What most likely happened?

    1. The server administrator blocked the scanner with a firewall.
    2. The server was patched.
    3. The vulnerability plug-ins were updated and no longer report false positives.
    4. The system was offline.
  25. While conducting reconnaissance, Piper discovers what she believes is an SMTP service running on an alternate port. What technique should she use to manually validate her guess?
    1. Send an email via the open port.
    2. Send an SMTP probe.
    3. Telnet to the port.
    4. SSH to the port.

    Use the following network diagram and scenario to answer questions 26–28.

    Marta is a security analyst who has been tasked with performing Nmap scans of her organization's network. She is a new hire and has been given this logical diagram of the organization's network but has not been provided with any additional detail.

    A system architecure. It involves internet and data center network.
  26. Marta wants to determine what IP addresses to scan from location A. How can she find this information?
    1. Scan the organization's web server and then scan the other 255 IP addresses in its subnet.
    2. Query DNS and WHOIS to find her organization's registered hosts.
    3. Contact ICANN to request the data.
    4. Use traceroute to identify the network that the organization's domain resides in.
  27. If Marta runs a scan from location B that targets the servers on the datacenter network and then runs a scan from location C, what differences is she most likely to see between the scans?
    1. The scans will match.
    2. Scans from location C will show no open ports.
    3. Scans from location C will show fewer open ports.
    4. Scans from location C will show more open ports.
  28. Marta wants to perform regular scans of the entire organizational network but only has a budget that supports buying hardware for a single scanner. Where should she place her scanner to have the most visibility and impact?
    1. Location A
    2. Location B
    3. Location C
    4. Location D
  29. Chris wants to gather as much information as he can about an organization using DNS harvesting techniques. Which of the following methods will easily provide the most useful information if they are all possible to conduct on the network he is targeting?
    1. DNS record enumeration
    2. Zone transfer
    3. Reverse lookup
    4. Domain brute-forcing
  30. Geoff wants to perform passive reconnaissance as part of an evaluation of his organization's security controls. Which of the following techniques is a valid technique to perform as part of a passive DNS assessment?
    1. A DNS forward or reverse lookup
    2. A zone transfer
    3. A WHOIS query
    4. Using maltego
  31. Mike's penetration test requires him to use passive mapping techniques to discover network topology. Which of the following tools is best suited to that task?
    1. Wireshark
    2. nmap
    3. netcat
    4. Angry IP Scanner
  32. When Scott performs an nmap scan with the -T flag set to 5, what variable is he changing?
    1. How fast the scan runs
    2. The TCP timeout flag it will set
    3. How many retries it will perform
    4. How long the scan will take to start up
  33. While application vulnerability scanning one of her target organizations web servers, Andrea notices that the server's hostname is resolving to a cloudflare.com host. What does Andrea know about her scan?
    1. It is being treated like a DDoS attack.
    2. It is scanning a CDN-hosted copy of the site.
    3. It will not return useful information.
    4. She cannot determine anything about the site based on this information.
  34. Part of Tracy's penetration testing assignment is to evaluate the WPA3 Enterprise protected wireless networks of her target organization. What major differences exist between reconnaissances of a wired network versus a wireless network?
    1. Encryption and physical accessibility
    2. Network access control and encryption
    3. Port security and physical accessibility
    4. Authentication and encryption
  35. Ian's company has an internal policy requiring that they perform regular port scans of all of their servers. Ian has been part of a recent effort to move his organization's servers to an infrastructure as a service (IaaS) provider. What change will Ian most likely need to make to his scanning efforts?
    1. Change scanning software.
    2. Follow the service provider's scan policies.
    3. Sign a security contract with the provider.
    4. Discontinue port scanning.
  36. Lauren wants to identify all the printers on the subnets she is scanning with nmap. Which of the following nmap commands will not provide her with a list of likely printers?
    1. nmap -sS -p 9100,515,631 10.0.10.15/22 -oX printers.txt
    2. nmap -O 10.0.10.15/22 -oG - | grep printer >> printers.txt
    3. nmap -sU -p 9100,515,631 10.0.10.15/22 -oX printers.txt
    4. nmap -sS -O 10.0.10.15/22 -oG | grep >> printers.txt
  37. What services will the following nmap scan test for? 
    nmap -sV -p 22,25,53,389 192.168.2.50/27
    1. Telnet, SMTP, DHCP, MS-SQL
    2. SSH, SMTP, DNS, LDAP
    3. Telnet, SNMP, DNS, LDAP
    4. SSH, SNMP, DNS, RDP
  38. While conducting a topology scan of a remote web server, Susan notes that the IP addresses returned for the same DNS entry change over time. What has she likely encountered?
    1. A route change
    2. Fast-flux DNS
    3. A load balancer
    4. An IP mismatch
  39. Nihar wants to conduct an nmap scan of a firewalled subnet. Which of the following is not an nmap firewall evasion technique he could use?
    1. Fragmenting packets
    2. Changing packet header flags
    3. Spoofing the source IP
    4. Appending random data
  40. When Casey scanned a network host, she received the results shown here. What does she know based on the scan results?
    A cropped window page depicts a result.
    1. The device is a Cisco device.
    2. The device is running Red Hat Linux.
    3. The device was built by IBM.
    4. None of the above.
  41. Aidan operates the point-of-sale network for a company that accepts credit cards and is thus required to be compliant with PCI DSS. During his regular assessment of the point-of-sale terminals, he discovers that a recent Windows operating system vulnerability exists on all of them. Since they are all embedded systems that require a manufacturer update, he knows that he cannot install the available patch. What is Aidan's best option to stay compliant with PCI DSS and protect his vulnerable systems?
    1. Replace the Windows embedded point-of-sale terminals with standard Windows systems.
    2. Build a custom operating system image that includes the patch.
    3. Identify, implement, and document compensating controls.
    4. Remove the POS terminals from the network until the vendor releases a patch.
  42. What occurs when Mia uses the following command to perform an nmap scan of a network? 
    nmap -sP 192.168.2.0/24
    1. A secure port scan of all hosts in the 192.168.0.0 to 192.168.2.255 network range
    2. A scan of all hosts that respond to ping in the 192.168.0.0 to 192.168.255.255 network range
    3. A scan of all hosts that respond to ping in the 192.168.2.0 to 192.168.2.255 network range
    4. A SYN-based port scan of all hosts in the 192.168.2.0 to 192.168.2.255 network range
  43. Amir's remote scans of a target organization's class C network block using the nmap command (nmap -sS 10.0.10.1/24) show only a single web server. If Amir needs to gather additional reconnaissance information about the organization's network, which of the following scanning techniques is most likely to provide additional detail?
    1. Use a UDP scan.
    2. Perform a scan from on-site.
    3. Scan using the -p 1-65535 flag.
    4. Use Nmap's IPS evasion techniques.
  44. Damian wants to limit the ability of attackers to conduct passive fingerprinting exercises on his network. Which of the following practices will help to mitigate this risk?
    1. Implement an IPS.
    2. Implement a firewall.
    3. Disable promiscuous mode for NICs.
    4. Enable promiscuous mode for NICs.
  45. As part of his active reconnaissance activities, Frank is provided with a shell account accessible via SSH. If Frank wants to run a default nmap scan on the network behind the firewall shown here, how can he accomplish this?
    A system network. It involves an external host and internal protected network.
    1. ssh -t 192.168.34.11 nmap 192.168.34.0/24
    2. ssh -R 8080:192.168.34.11:8080 [remote account:remote password]
    3. ssh -proxy 192.168.11 [remote account:remote password]
    4. Frank cannot scan multiple ports with a single ssh command.
  46. Angela captured the following packets during a reconnaissance effort run by her organization's red team. What type of information are they looking for?
    A window page presents the number, time, source, destination, protocol, length, and information data.
    1. Vulnerable web applications
    2. SQL injection
    3. Directory traversal attacks
    4. Passwords
  47. Stacey encountered a system that shows as “filtered” and “firewalled” during an nmap scan. Which of the following techniques should she not consider as she is planning her next scan?
    1. Packet fragmentation
    2. Spoofing the source address
    3. Using decoy scans
    4. Spoofing the destination address
  48. Kim is preparing to deploy a new vulnerability scanner and wants to ensure that she can get the most accurate view of configuration issues on laptops belonging to traveling salespeople. Which technology will work best in this situation?
    1. Agent-based scanning
    2. Server-based scanning
    3. Passive network monitoring
    4. Noncredentialed scanning
  49. Carla runs a vulnerability scan of a new appliance that engineers are planning to place on her organization's network and finds the results shown here. Of the actions listed, which would correct the highest criticality vulnerability?
    A window page depicts the data on vulnerabilities.
    1. Block the use of TLS v1.0.
    2. Replace the expired SSL certificate.
    3. Remove the load balancer.
    4. Correct the information leakage vulnerability.
  50. Sadiq is responsible for the security of a network used to control systems within his organization's manufacturing plant. The network connects manufacturing equipment, sensors, and controllers. He runs a vulnerability scan on this network and discovers that several of the controllers are running out-of-date firmware that introduces security issues. The manufacturer of the controllers is out of business. What action can Sadiq take to best remediate this vulnerability in an efficient manner?
    1. Develop a firmware update internally and apply it to the controllers.
    2. Post on an Internet message board seeking other organizations that have developed a patch.
    3. Ensure that the ICS is on an isolated network.
    4. Use an intrusion prevention system on the ICS network.
  51. Vic scanned a Windows server used in his organization and found the result shown here. The server is on an internal network with access limited to IT staff and is not part of a domain. How urgently should Vic remediate this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Vic should drop everything and remediate this vulnerability immediately.
    2. While Vic does not need to drop everything, this vulnerability requires urgent attention and should be addressed quickly.
    3. This is a moderate vulnerability that can be scheduled for remediation at a convenient time.
    4. This vulnerability is informational in nature and may be left in place.
  52. Rob's manager recently asked him for an overview of any critical security issues that exist on his network. He looks at the reporting console of his vulnerability scanner and sees the options shown here. Which of the following report types would be his best likely starting point?
    A table presents the title, type, and vulnerability data.
    1. Technical Report
    2. High Severity Report
    3. Qualys Patch Report
    4. Unknown Device Report
  53. Wendy is the security administrator for a membership association that is planning to launch an online store. As part of this launch, she will become responsible for ensuring that the website and associated systems are compliant with all relevant standards. What regulatory regime specifically covers credit card information?
    1. PCI DSS
    2. FERPA
    3. HIPAA
    4. SOX
  54. During a port scan of a server, Miguel discovered that the following ports are open on the internal network:
    • TCP port 25
    • TCP port 80
    • TCP port 110
    • TCP port 443
    • TCP port 1433
    • TCP port 3389

    The scan results provide evidence that a variety of services are running on this server. Which one of the following services is not indicated by the scan results?

    1. Web
    2. Database
    3. SSH
    4. RDP
  55. Nina is a software developer, and she receives a report from her company's cybersecurity team that a vulnerability scan detected a SQL injection vulnerability in one of her applications. She examines her code and makes a modification in a test environment that she believes corrects the issue. What should she do next?
    1. Deploy the code to production immediately to resolve the vulnerability.
    2. Request a scan of the test environment to confirm that the issue is corrected.
    3. Mark the vulnerability as resolved and close the ticket.
    4. Hire a consultant to perform a penetration test to confirm that the vulnerability is resolved.
  56. George recently ran a port scan on a network device used by his organization. Which one of the following open ports represents the most significant possible security vulnerability?
    1. 22
    2. 23
    3. 161
    4. 443

    Use the following scenario to answer questions 57–59.

    Harold runs a vulnerability scan of a server that he is planning to move into production and finds the vulnerability shown here.

    A window page presents the first detected, last detected, time detected, and last fixed data.
  57. What operating system is most likely running on the server in this vulnerability scan report?
    1. macOS
    2. Windows
    3. Kali
    4. RHEL
  58. Harold is preparing to correct the vulnerability. What service should he inspect to identify the issue?
    1. SSH
    2. HTTPS
    3. RDP
    4. SFTP
  59. Harold would like to secure the service affected by this vulnerability. Which one of the following protocols/versions would be an acceptable way to resolve the issue?
    1. SSL v2.0
    2. SSL v3.0
    3. TLS v1.0
    4. None of the above
  60. Seth found the vulnerability shown here in one of the systems on his network. What component requires a patch to correct this issue?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Operating system
    2. VPN concentrator
    3. Network router or switch
    4. Hypervisor
  61. Quentin ran a vulnerability scan of a server in his organization and discovered the results shown here. Which one of the following actions is not required to resolve one of the vulnerabilities on this server?
    A window page depicts the data on vulnerabilities.
    1. Reconfigure cipher support.
    2. Apply Window security patches.
    3. Obtain a new SSL certificate.
    4. Enhance account security policies.
  62. The presence of ____________ triggers specific vulnerability scanning requirements based on law or regulation.
    1. Credit card information
    2. Protected health information
    3. Personally identifiable information
    4. Trade secret information

    Use the scenario to answer questions 63–65.

    Stella is analyzing the results of a vulnerability scan and comes across the vulnerability shown here on a server in her organization. The SharePoint service in question processes all of the organization's work orders and is a critical part of the routine business workflow.

    A window page presents the first detected, last detected, time detected, and last fixed data.
  63. What priority should Stella place on remediating this vulnerability?
    1. Stella should make this vulnerability one of her highest priorities.
    2. Stella should remediate this vulnerability within the next several weeks.
    3. Stella should remediate this vulnerability within the next several months.
    4. Stella does not need to assign any priority to remediating this vulnerability.
  64. What operating system is most likely running on the server in this vulnerability scan report?
    1. macOS
    2. Windows
    3. Kali
    4. RHEL
  65. What is the best way that Stella can correct this vulnerability?
    1. Deploy an intrusion prevention system.
    2. Apply one or more application patches.
    3. Apply one or more operating system patches.
    4. Disable the service.
  66. Harry is developing a vulnerability scanning program for a large network of sensors used by his organization to monitor a transcontinental gas pipeline. What term is commonly used to describe this type of sensor network?
    1. WLAN
    2. VPN
    3. P2P
    4. SCADA
  67. This morning, Eric ran a vulnerability scan in an attempt to detect a vulnerability that was announced by a software manufacturer yesterday afternoon. The scanner did not detect the vulnerability although Eric knows that at least two of his servers should have the issue. Eric contacted the vulnerability scanning vendor, who assured him that they released a signature for the vulnerability overnight. What should Eric do as a next step?
    1. Check the affected servers to verify a false positive.
    2. Check the affected servers to verify a false negative.
    3. Report a bug to the vendor.
    4. Update the vulnerability signatures.
  68. Natalie ran a vulnerability scan of a web application recently deployed by her organization, and the scan result reported a blind SQL injection. She reported the vulnerability to the developers, who scoured the application and made a few modifications but did not see any evidence that this attack was possible. Natalie reran the scan and received the same result. The developers are now insisting that their code is secure. What is the most likely scenario?
    1. The result is a false positive.
    2. The code is deficient and requires correction.
    3. The vulnerability is in a different web application running on the same server.
    4. Natalie is misreading the scan report.
  69. Kasun discovers a missing Windows security patch during a vulnerability scan of a server in his organization's datacenter. Upon further investigation, he discovers that the system is virtualized. Where should he apply the patch?
    1. To the virtualized system
    2. The patch is not necessary
    3. To the domain controller
    4. To the virtualization platform
  70. Joaquin is frustrated at the high level of false positive reports produced by his vulnerability scans and is contemplating a series of actions designed to reduce the false positive rate. Which one of the following actions is least likely to have the desired effect?
    1. Moving to credentialed scanning
    2. Moving to agent-based scanning
    3. Integrating asset information into the scan
    4. Increasing the sensitivity of scans
  71. Joe is conducting a network vulnerability scan against his datacenter and receives reports from system administrators that the scans are slowing down their systems. There are no network connectivity issues, only performance problems on individual hosts. He looks at the scan settings shown here. Which setting would be most likely to correct the problem?
    A window page exposes the general settings and the performance options.
    1. Scan IP addresses in a random order
    2. Network timeout (in seconds)
    3. Max simultaneous checks per host
    4. Max simultaneous hosts per scan
  72. Isidora runs a vulnerability scan of the management interface for her organization's DNS service. She receives the vulnerability report shown here. What should be Isidora's next action?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Disable the use of cookies on this service.
    2. Request that the vendor rewrite the interface to avoid this vulnerability.
    3. Investigate the contents of the cookie.
    4. Shut down the DNS service.
  73. Zara is prioritizing vulnerability scans and would like to base the frequency of scanning on the information asset value. Which of the following criteria would be most appropriate for her to use in this analysis?
    1. Cost of hardware acquisition
    2. Cost of hardware replacement
    3. Types of information processed
    4. Depreciated hardware cost
  74. Laura is working to upgrade her organization's vulnerability management program. She would like to add technology that is capable of retrieving the configurations of systems, even when they are highly secured. Many systems use local authentication, and she wants to avoid the burden of maintaining accounts on all of those systems. What technology should Laura consider to meet her requirement?
    1. Credentialed scanning
    2. Uncredentialed scanning
    3. Server-based scanning
    4. Agent-based scanning
  75. Javier discovered the vulnerability shown here in a system on his network. He is unsure what system component is affected. What type of service is causing this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Backup service
    2. Database service
    3. File sharing
    4. Web service
  76. Alicia runs a vulnerability scan of a server being prepared for production and finds the vulnerability shown here. Which one of the following actions is least likely to reduce this risk?
    A window page depicts the threat, impact, solution, compliance, exploitability, associated malware, and the results.
    1. Block all connections on port 22.
    2. Upgrade OpenSSH.
    3. Disable AES-GCM in the server configuration.
    4. Install a network IPS in front of the server.
  77. After scanning his organization's email server, Singh discovered the vulnerability shown here. What is the most effective response that Singh can take in this situation?
    A window page presents the description, solution, plugin details, risk information, port, hosts, output, vulnerability information, and reference information.
    1. Upgrade to the most recent version of Microsoft Exchange.
    2. Upgrade to the most recent version of Microsoft Windows.
    3. Implement the use of strong encryption.
    4. No action is required.
  78. A SQL injection exploit typically gains access to a database by exploiting a vulnerability in a(n)__________.
    1. Operating system
    2. Web application
    3. Database server
    4. Firewall

    Use the following scenario to answer questions 79–81.

    Ryan ran a vulnerability scan of one of his organization's production systems and received the report shown here. He would like to understand this vulnerability better and then remediate the issue.

    A window page presents the first detected, last detected, time detected, and last fixed data.
  79. Ryan will not be able to correct the vulnerability for several days. In the meantime, he would like to configure his intrusion prevention system to watch for issues related to this vulnerability. Which one of the following protocols would an attacker use to exploit this vulnerability?
    1. SSH
    2. HTTPS
    3. FTP
    4. RDP
  80. Which one of the following actions could Ryan take to remediate the underlying issue without disrupting business activity?
    1. Disable the IIS service.
    2. Apply a security patch.
    3. Modify the web application.
    4. Apply IPS rules.
  81. If an attacker is able to exploit this vulnerability, what is the probable result that will have the highest impact on the organization?
    1. Administrative control of the server
    2. Complete control of the domain
    3. Access to configuration information
    4. Access to web application logs
  82. Ted is configuring vulnerability scanning for a file server on his company's internal network. The server is positioned on the network as shown here. What types of vulnerability scans should Ted perform to balance the efficiency of scanning effort with expected results?
    A system architecture. It involves internet, firewall, data center network, database server, file server, screened subnet, and web server.
    1. Ted should not perform scans of servers on the internal network.
    2. Ted should perform only internal vulnerability scans.
    3. Ted should perform only external vulnerability scans.
    4. Ted should perform both internal and external vulnerability scans.
  83. Zahra is attempting to determine the next task that she should take on from a list of security priorities. Her boss told her that she should focus on activities that have the most “bang for the buck.” Of the tasks shown here, which should she tackle first?
    A table represents the data on security issue, criticality, and time required to fix.
    1. Task 1
    2. Task 2
    3. Task 3
    4. Task 4
  84. Morgan is interpreting the vulnerability scan from her organization's network, shown here. She would like to determine which vulnerability to remediate first. Morgan would like to focus on vulnerabilities that are most easily exploitable by someone outside her organization. Assuming the firewall is properly configured, which one of the following vulnerabilities should Morgan give the highest priority?
    A system architecture. It involves internet, firewall, internal network, workstation, file server, web server, screened subnet, and email server.
    1. Severity 5 vulnerability in the workstation
    2. Severity 1 vulnerability in the file server
    3. Severity 5 vulnerability in the web server
    4. Severity 1 vulnerability in the mail server
  85. Mike runs a vulnerability scan against his company's virtualization environment and finds the vulnerability shown here in several of the virtual hosts. What action should Mike take?
    A cropped window page presents the HTTP methods allowed.
    1. No action is necessary because this is an informational report.
    2. Mike should disable HTTPS on the affected devices.
    3. Mike should upgrade the version of OpenSSL on the affected devices.
    4. Mike should immediately upgrade the hypervisor.
  86. Juan recently scanned a system and found that it was running services on ports 139 and 445. What operating system is this system most likely running?
    1. Ubuntu
    2. macOS
    3. Kali
    4. Windows
  87. Gene is concerned about the theft of sensitive information stored in a database. Which one of the following vulnerabilities would pose the most direct threat to this information?
    1. SQL injection
    2. Cross-site scripting
    3. Buffer overflow
    4. Denial of service
  88. Which one of the following protocols is not likely to trigger a vulnerability scan alert when used to support a virtual private network (VPN)?
    1. IPsec
    2. SSL v2
    3. PPTP
    4. SSL v3
  89. Rahul ran a vulnerability scan of a server that will be used for credit card processing in his environment and received a report containing the vulnerability shown here. What action must Rahul take?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Remediate the vulnerability when possible.
    2. Remediate the vulnerability prior to moving the system into production and rerun the scan to obtain a clean result.
    3. Remediate the vulnerability within 90 days of moving the system to production.
    4. No action is required.

    Use the following scenario to answer questions 90–91.

    Aaron is scanning a server in his organization's datacenter and receives the vulnerability report shown here. The service is exposed only to internal hosts.

    A window page presents the first detected, last detected, time detected, and last fixed data.
  90. What is the normal function of the service with this vulnerability?
    1. File transfer
    2. Web hosting
    3. Time synchronization
    4. Network addressing
  91. What priority should Aaron place on remediating this vulnerability?
    1. Aaron should make this vulnerability his highest priority.
    2. Aaron should remediate this vulnerability urgently but does not need to drop everything.
    3. Aaron should remediate this vulnerability within the next month.
    4. Aaron does not need to assign any priority to remediating this vulnerability.
  92. Without access to any additional information, which one of the following vulnerabilities would you consider the most severe if discovered on a production web server?
    1. CGI generic SQL injection
    2. Web application information disclosure
    3. Web server uses basic authentication without HTTPS
    4. Web server directory enumeration
  93. Gina ran a vulnerability scan on three systems that her organization is planning to move to production and received the results shown here. How many of these issues should Gina require be resolved before moving to production?
    A window page presents the data on vulnerabilities.
    1. 0.
    2. 1.
    3. 3.
    4. All of these issues should be resolved.
  94. Ji-won recently restarted an old vulnerability scanner that had not been used in more than a year. She booted the scanner, logged in, and configured a scan to run. After reading the scan results, she found that the scanner was not detecting known vulnerabilities that were detected by other scanners. What is the most likely cause of this issue?
    1. The scanner is running on an outdated operating system.
    2. The scanner's maintenance subscription is expired.
    3. Ji-won has invalid credentials on the scanner.
    4. The scanner does not have a current, valid IP address.
  95. Isabella runs both internal and external vulnerability scans of a web server and detects a possible SQL injection vulnerability. The vulnerability appears only in the internal scan and does not appear in the external scan. When Isabella checks the server logs, she sees the requests coming from the internal scan and sees some requests from the external scanner but no evidence that a SQL injection exploit was attempted by the external scanner. What is the most likely explanation for these results?
    1. A host firewall is blocking external network connections to the web server.
    2. A network firewall is blocking external network connections to the web server.
    3. A host IPS is blocking some requests to the web server.
    4. A network IPS is blocking some requests to the web server.
  96. Rick discovers the vulnerability shown here in a server running in his datacenter. What characteristic of this vulnerability should concern him the most?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. It is the subject of a recent security bulletin.
    2. It has a CVSS score of 7.8.
    3. There are multiple Bugtraq and CVE IDs.
    4. It affects kernel-mode drivers.
  97. Carl runs a vulnerability scan of a mail server used by his organization and receives the vulnerability report shown here. What action should Carl take to correct this issue?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Carl does not need to take any action because this is an informational report.
    2. Carl should replace SSL with TLS on this server.
    3. Carl should disable weak ciphers.
    4. Carl should upgrade OpenSSL.
  98. Renee is configuring a vulnerability scanner that will run scans of her network. Corporate policy requires the use of daily vulnerability scans. What would be the best time to configure the scans?
    1. During the day when operations reach their peak to stress test systems
    2. During the evening when operations are minimal to reduce the impact on systems
    3. During lunch hour when people have stepped away from their systems but there is still considerable load
    4. On the weekends when the scans may run unimpeded
  99. Ahmed is reviewing the vulnerability scan report from his organization's central storage service and finds the results shown here. Which action can Ahmed take that will be effective in remediating the highest-severity issue possible?
    A window page presents the data on vulnerabilities.
    1. Upgrade to SNMP v3.
    2. Disable the use of RC4.
    3. Replace the use of SSL with TLS.
    4. Disable remote share enumeration.

    Use the following scenario to answer questions 100–101.

    Glenda ran a vulnerability scan of workstations in her organization. She noticed that many of the workstations reported the vulnerability shown here. She would like to not only correct this issue but also prevent the likelihood of similar issues occurring in the future.

    A window page presents the first detected, last detected, time detected, and last fixed data.
  100. What action should Glenda take to achieve her goals?
    1. Glenda should uninstall Chrome from all workstations and replace it with Internet Explorer.
    2. Glenda should manually upgrade Chrome on all workstations.
    3. Glenda should configure all workstations to automatically upgrade Chrome.
    4. Glenda does not need to take any action.
  101. What priority should Glenda place on remediating this vulnerability?
    1. Glenda should make this vulnerability her highest priority.
    2. Glenda should remediate this vulnerability urgently but does not need to drop everything.
    3. Glenda should remediate this vulnerability within the next several months.
    4. Glenda does not need to assign any priority to remediating this vulnerability.
  102. After reviewing the results of a vulnerability scan, Gabriella discovered a flaw in her Oracle database server that may allow an attacker to attempt a direct connection to the server. She would like to review NetFlow logs to determine what systems have connected to the server recently. What TCP port should Gabriella expect to find used for this communication?
    1. 443
    2. 1433
    3. 1521
    4. 8080
  103. Terry recently ran a vulnerability scan against his organization's credit card processing environment that found a number of vulnerabilities. Which vulnerabilities must he remediate to have a “clean” scan under PCI DSS standards?
    1. Critical vulnerabilities
    2. Critical and high vulnerabilities
    3. Critical, high, and medium vulnerabilities
    4. Critical, high, medium, and low vulnerabilities
  104. Himari discovers the vulnerability shown here on several Windows systems in her organization. There is a patch available, but it requires compatibility testing that will take several days to complete. What type of file should Himari be watchful for because it may directly exploit this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Private key files
    2. Word documents
    3. Image files
    4. Encrypted files
  105. Aaron is configuring a vulnerability scan for a Class C network and is trying to choose a port setting from the list shown here. He would like to choose a scan option that will efficiently scan his network but also complete in a reasonable period of time. Which setting would be most appropriate?
    A cropped window page depicts a set of settings.
    1. None
    2. Full
    3. Standard Scan
    4. Light Scan
  106. Haruto is reviewing the results of a vulnerability scan, shown here, from a web server in his organization. Access to this server is restricted at the firewall so that it may not be accessed on port 80 or 443. Which of the following vulnerabilities should Haruto still address?
    A window page presents the data on vulnerabilities.
    1. OpenSSL version.
    2. Cookie information disclosure.
    3. TRACK/TRACE methods.
    4. Haruto does not need to address any of these vulnerabilities because they are not exposed to the outside world.
  107. Brian is considering the use of several different categories of vulnerability plug-ins. Of the types listed here, which is the most likely to result in false positive reports?
    1. Registry inspection
    2. Banner grabbing
    3. Service interrogation
    4. Fuzzing
  108. Binh conducts a vulnerability scan and finds three different vulnerabilities, with the CVSS scores shown here. Which vulnerability should be his highest priority to fix, assuming all three fixes are of equal difficulty?
    A set of 3 different vulnerabilities.
    1. Vulnerability 1.
    2. Vulnerability 2.
    3. Vulnerability 3.
    4. Vulnerabilities 1 and 3 are equal in priority.
  109. Which one of the following is not an appropriate criterion to use when prioritizing the remediation of vulnerabilities?
    1. Network exposure of the affected system.
    2. Difficulty of remediation.
    3. Severity of the vulnerability.
    4. All of these are appropriate.
  110. Landon is preparing to run a vulnerability scan of a dedicated Apache server that his organization is planning to move into a screened subnet (DMZ). Which one of the following vulnerability scans is least likely to provide informative results?
    1. Web application vulnerability scan
    2. Database vulnerability scan
    3. Port scan
    4. Network vulnerability scan
  111. Ken recently received the vulnerability report shown here that affects a file server used by his organization. What is the primary nature of the risk introduced by this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Confidentiality
    2. Integrity
    3. Availability
    4. Nonrepudiation
  112. Aadesh is creating a vulnerability management program for his company. He has limited scanning resources and would like to apply them to different systems based on the sensitivity and criticality of the information that they handle. What criteria should Aadesh use to determine the vulnerability scanning frequency?
    1. Data remanence
    2. Data privacy
    3. Data classification
    4. Data sovereignty
  113. Tom recently read a media report about a ransomware outbreak that was spreading rapidly across the Internet by exploiting a zero-day vulnerability in Microsoft Windows. As part of a comprehensive response, he would like to include a control that would allow his organization to effectively recover from a ransomware infection. Which one of the following controls would best achieve Tom's objective?
    1. Security patching
    2. Host firewalls
    3. Backups
    4. Intrusion prevention systems
  114. Kaitlyn discovered the vulnerability shown here on a workstation in her organization. Which one of the following is not an acceptable method for remediating this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Upgrade WinRAR.
    2. Upgrade Windows.
    3. Remove WinRAR.
    4. Replace WinRAR with an alternate compression utility.
  115. Brent ran a vulnerability scan of several network infrastructure devices on his network and obtained the result shown here. What is the extent of the impact that an attacker could have by exploiting this vulnerability directly?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Denial of service
    2. Theft of sensitive information
    3. Network eavesdropping
    4. Reconnaissance
  116. Yashvir runs the cybersecurity vulnerability management program for his organization. He sends a database administrator a report of a missing database patch that corrects a high severity security issue. The DBA writes back to Yashvir that he has applied the patch. Yashvir reruns the scan, and it still reports the same vulnerability. What should he do next?
    1. Mark the vulnerability as a false positive.
    2. Ask the DBA to recheck the database server.
    3. Mark the vulnerability as an exception.
    4. Escalate the issue to the DBA's manager.
  117. Manya is reviewing the results of a vulnerability scan and identifies the issue shown here in one of her systems. She consults with developers who check the code and assure her that it is not vulnerable to SQL injection attacks. An independent auditor confirms this for Manya. What is the most likely scenario?
    A window page presents the data on CGI generic SQL injection.
    1. This is a false positive report.
    2. The developers are wrong, and the vulnerability exists.
    3. The scanner is malfunctioning.
    4. The database server is misconfigured.
  118. Erik is reviewing the results of a vulnerability scan and comes across the vulnerability report shown here. Which one of the following services is least likely to be affected by this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. HTTPS
    2. HTTP
    3. SSH
    4. VPN

    Use the following scenario to answer questions 119–120.

    Larry recently discovered a critical vulnerability in one of his organization's database servers during a routine vulnerability scan. When he showed the report to a database administrator, the administrator responded that they had corrected the vulnerability by using a vendor-supplied workaround because upgrading the database would disrupt an important process. Larry verified that the workaround is in place and corrects the vulnerability.

  119. How should Larry respond to this situation?
    1. Mark the report as a false positive.
    2. Insist that the administrator apply the vendor patch.
    3. Mark the report as an exception.
    4. Require that the administrator submit a report describing the workaround after each vulnerability scan.
  120. What is the most likely cause of this report?
    1. The vulnerability scanner requires an update.
    2. The vulnerability scanner depends on version detection.
    3. The database administrator incorrectly applied the workaround.
    4. Larry misconfigured the scan.
  121. Mila ran a vulnerability scan of a server in her organization and found the vulnerability shown here. What is the use of the service affected by this vulnerability?
    A window page depicts the data on POP3 cleartext logins permitted.
    1. Web server
    2. Database server
    3. Email server
    4. Directory server
  122. Margot discovered that a server in her organization has a SQL injection vulnerability. She would like to investigate whether attackers have attempted to exploit this vulnerability. Which one of the following data sources is least likely to provide helpful information?
    1. NetFlow logs
    2. Web server logs
    3. Database logs
    4. IDS logs
  123. Krista is reviewing a vulnerability scan report and comes across the vulnerability shown here. She comes from a Linux background and is not as familiar with Windows administration. She is not familiar with the runas command mentioned in this vulnerability. What is the closest Linux equivalent command?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. sudo
    2. grep
    3. su
    4. ps
  124. After scanning a web application for possible vulnerabilities, Barry received the result shown here. Which one of the following best describes the threat posed by this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. An attacker can eavesdrop on authentication exchanges.
    2. An attacker can cause a denial-of-service attack on the web application.
    3. An attacker can disrupt the encryption mechanism used by this server.
    4. An attacker can edit the application code running on this server.
  125. Javier ran a vulnerability scan of a network device used by his organization and discovered the vulnerability shown here. What type of attack would this vulnerability enable?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Denial of service
    2. Information theft
    3. Information alteration
    4. Reconnaissance
  126. Akari scans a Windows server in her organization and finds that it has multiple critical vulnerabilities, detailed in the report shown here. What action can Akari take that will have the most significant impact on these issues without creating a long-term outage?
    A window page depicts the data on vulnerabilities.
    1. Configure the host firewall to block inbound connections.
    2. Apply security patches.
    3. Disable the guest account on the server.
    4. Configure the server to only use secure ciphers.
  127. During a recent vulnerability scan of workstations on her network, Andrea discovered the vulnerability shown here. Which one of the following actions is least likely to remediate this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Remove JRE from workstations.
    2. Upgrade JRE to the most recent version.
    3. Block inbound connections on port 80 using the host firewall.
    4. Use a web content filtering system to scan for malicious traffic.
  128. Doug is preparing an RFP for a vulnerability scanner for his organization. He needs to know the number of systems on his network to help determine the scanner requirements. Which one of the following would not be an easy way to obtain this information?
    1. ARP tables
    2. Asset management tool
    3. Discovery scan
    4. Results of scans recently run by a consultant
  129. Mary runs a vulnerability scan of her entire organization and shares the report with another analyst on her team. An excerpt from that report appears here. Her colleague points out that the report contains only vulnerabilities with severities of 3, 4, or 5. What is the most likely cause of this result?
    A window page depicts the data on vulnerabilities.
    1. The scan sensitivity is set to exclude low-importance vulnerabilities.
    2. Mary did not configure the scan properly.
    3. Systems in the datacenter do not contain any level 1 or 2 vulnerabilities.
    4. The scan sensitivity is set to exclude high-impact vulnerabilities.
  130. Mikhail is reviewing the vulnerability shown here, which was detected on several servers in his environment. What action should Mikhail take?
    A window page depicts the data on TCP or IP timestamp supported.
    1. Block TCP/IP access to these servers from external sources.
    2. Upgrade the operating system on these servers.
    3. Encrypt all access to these servers.
    4. No action is necessary.
  131. Which one of the following approaches provides the most current and accurate information about vulnerabilities present on a system because of the misconfiguration of operating system settings?
    1. On-demand vulnerability scanning
    2. Continuous vulnerability scanning
    3. Scheduled vulnerability scanning
    4. Agent-based monitoring

    Use the following scenario to answer questions 132–134.

    Pete recently conducted a broad vulnerability scan of all the servers and workstations in his environment. He scanned the following three networks:

    • Screened subnet (DMZ) network that contains servers with public exposure
    • Workstation network that contains workstations that are allowed outbound access only
    • Internal server network that contains servers exposed only to internal systems

    He detected the following vulnerabilities:

    • Vulnerability 1: A SQL injection vulnerability on a screened subnet (DMZ) server that would grant access to a database server on the internal network (severity 5/5)
    • Vulnerability 2: A buffer overflow vulnerability on a domain controller on the internal server network (severity 3/5)
    • Vulnerability 3: A missing security patch on several hundred Windows workstations on the workstation network (severity 2/5)
    • Vulnerability 4: A denial-of-service vulnerability on a screened subnet (DMZ) server that would allow an attacker to disrupt a public-facing website (severity 2/5)
    • Vulnerability 5: A denial-of-service vulnerability on an internal server that would allow an attacker to disrupt an internal website (severity 4/5)

    Note that the severity ratings assigned to these vulnerabilities are directly from the vulnerability scanner and were not assigned by Pete.

  132. Absent any other information, which one of the vulnerabilities in the report should Pete remediate first?
    1. Vulnerability 1
    2. Vulnerability 2
    3. Vulnerability 3
    4. Vulnerability 4
  133. Pete is working with the desktop support manager to remediate vulnerability 3. What would be the most efficient way to correct this issue?
    1. Personally visit each workstation to remediate the vulnerability.
    2. Remotely connect to each workstation to remediate the vulnerability.
    3. Perform registry updates using a remote configuration tool.
    4. Apply the patch using a GPO.
  134. Pete recently conferred with the organization's CISO, and the team is launching an initiative designed to combat the insider threat. They are particularly concerned about the theft of information by employees seeking to exceed their authorized access. Which one of the vulnerabilities in this report is of greatest concern given this priority?
    1. Vulnerability 2
    2. Vulnerability 3
    3. Vulnerability 4
    4. Vulnerability 5
  135. Wanda recently discovered the vulnerability shown here on a Windows server in her organization. She is unable to apply the patch to the server for six weeks because of operational issues. What workaround would be most effective in limiting the likelihood that this vulnerability would be exploited?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Restrict interactive logins to the system.
    2. Remove Microsoft Office from the server.
    3. Remove Internet Explorer from the server.
    4. Apply the security patch.
  136. Garrett is configuring vulnerability scanning for a new web server that his organization is deploying on its screened subnet (DMZ) network. The server hosts the company's public website. What type of scanning should Garrett configure for best results?
    1. Garrett should not perform scanning of screened subnet (DMZ) systems.
    2. Garrett should perform external scanning only.
    3. Garrett should perform internal scanning only.
    4. Garrett should perform both internal and external scanning.
  137. Frank recently ran a vulnerability scan and identified a POS terminal that contains an unpatchable vulnerability because of running an unsupported operating system. Frank consults with his manager and is told that the POS is being used with full knowledge of management and, as a compensating control, it has been placed on an isolated network with no access to other systems. Frank's manager tells him that the merchant bank is aware of the issue. How should Frank handle this situation?
    1. Document the vulnerability as an approved exception.
    2. Explain to his manager that PCI DSS does not permit the use of unsupported operating systems.
    3. Decommission the POS system immediately to avoid personal liability.
    4. Upgrade the operating system immediately.
  138. James is configuring vulnerability scans of a dedicated network that his organization uses for processing credit card transactions. What types of scans are least important for James to include in his scanning program?
    1. Scans from a dedicated scanner on the card processing network.
    2. Scans from an external scanner on his organization's network.
    3. Scans from an external scanner operated by an approved scanning vendor.
    4. All three types of scans are equally important.
  139. Helen performs a vulnerability scan of one of the internal LANs within her organization and finds a report of a web application vulnerability on a device. Upon investigation, she discovers that the device in question is a printer. What is the most likely scenario in this case?
    1. The printer is running an embedded web server.
    2. The report is a false positive result.
    3. The printer recently changed IP addresses.
    4. Helen inadvertently scanned the wrong network.
  140. Julian recently detected the vulnerability shown here on several servers in his environment. Because of the critical nature of the vulnerability, he would like to block all access to the affected service until it is resolved using a firewall rule. He verifies that the following TCP ports are open on the host firewall. Which one of the following does Julian not need to block to restrict access to this service?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. 137
    2. 139
    3. 389
    4. 445
  141. Ted recently ran a vulnerability scan of his network and was overwhelmed with results. He would like to focus on the most important vulnerabilities. How should Ted reconfigure his vulnerability scanner?
    1. Increase the scan sensitivity.
    2. Decrease the scan sensitivity.
    3. Increase the scan frequency.
    4. Decrease the scan frequency.
  142. Sunitha discovered the vulnerability shown here in an application developed by her organization. What application security technique is most likely to resolve this issue?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Input validation
    2. Network segmentation
    3. Parameter handling
    4. Tag removal
  143. Sherry runs a vulnerability scan and receives the high-level results shown here. Her priority is to remediate the most important vulnerabilities first. Which system should be her highest priority?
    An illustration depicts the results of 4 systems.
    1. A
    2. B
    3. C
    4. D
  144. Victor is configuring a new vulnerability scanner. He set the scanner to run scans of his entire datacenter each evening. When he went to check the scan reports at the end of the week, he found that they were all incomplete. The scan reports noted the error “Scan terminated due to start of preempting job.” Victor has no funds remaining to invest in the vulnerability scanning system. He does want to cover the entire datacenter. What should he do to ensure that scans complete?
    1. Reduce the number of systems scanned.
    2. Increase the number of scanners.
    3. Upgrade the scanner hardware.
    4. Reduce the scanning frequency.
  145. Vanessa ran a vulnerability scan of a server and received the results shown here. Her boss instructed her to prioritize remediation based on criticality. Which issue should she address first?
    A window page depicts the data on severity, plugin name, plugin family, and count.
    1. Remove the POP server.
    2. Remove the FTP server.
    3. Upgrade the web server.
    4. Remove insecure cryptographic protocols.
  146. Terry is reviewing a vulnerability scan of a Windows server and came across the vulnerability shown here. What is the risk presented by this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. An attacker may be able to execute a buffer overflow and execute arbitrary code on the server.
    2. An attacker may be able to conduct a denial-of-service attack against this server.
    3. An attacker may be able to determine the operating system version on this server.
    4. There is no direct vulnerability, but this information points to other possible vulnerabilities on the server.
  147. Andrea recently discovered the vulnerability shown here on the workstation belonging to a system administrator in her organization. What is the major likely threat that should concern Andrea?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. An attacker could exploit this vulnerability to take control of the administrator's workstation.
    2. An attacker could exploit this vulnerability to gain access to servers managed by the administrator.
    3. An attacker could exploit this vulnerability to prevent the administrator from using the workstation.
    4. An attacker could exploit this vulnerability to decrypt sensitive information stored on the administrator's workstation.
  148. Avik recently conducted a PCI DSS vulnerability scan of a web server and noted a critical PHP vulnerability that required an upgrade to correct. She applied the update. How soon must Avik repeat the scan?
    1. Within 30 days
    2. At the next scheduled quarterly scan
    3. At the next scheduled annual scan
    4. Immediately
  149. Chandra's organization recently upgraded the firewall protecting the network where they process credit card information. This network is subject to the provisions of PCI DSS. When is Chandra required to schedule the next vulnerability scan of this network?
    1. Immediately
    2. Within one month
    3. Before the start of next month
    4. Before the end of the quarter following the upgrade
  150. Fahad is concerned about the security of an industrial control system (ICS) that his organization uses to monitor and manage systems in their factories. He would like to reduce the risk of an attacker penetrating this system. Which one of the following security controls would best mitigate the vulnerabilities in this type of system?
    1. Network segmentation
    2. Input validation
    3. Memory protection
    4. Redundancy
  151. Raphael discovered during a vulnerability scan that an administrative interface to one of his storage systems was inadvertently exposed to the Internet. He is reviewing firewall logs and would like to determine whether any access attempts came from external sources. Which one of the following IP addresses reflects an external source?
    1. 10.15.1.100
    2. 12.8.1.100
    3. 172.16.1.100
    4. 192.168.1.100
  152. Nick is configuring vulnerability scans for his network using a third-party vulnerability scanning service. He is attempting to scan a web server that he knows exposes a CIFS file share and contains several significant vulnerabilities. However, the scan results only show ports 80 and 443 as open. What is the most likely cause of these scan results?
    1. The CIFS file share is running on port 443.
    2. A firewall configuration is preventing the scan from succeeding.
    3. The scanner configuration is preventing the scan from succeeding.
    4. The CIFS file share is running on port 80.
  153. Thomas learned this morning of a critical security flaw that affects a major service used by his organization and requires immediate patching. This flaw was the subject of news reports and is being actively exploited. Thomas has a patch and informed stakeholders of the issue and received permission to apply the patch during business hours. How should he handle the change management process?
    1. Thomas should apply the patch and then follow up with an emergency change request after work is complete.
    2. Thomas should initiate a standard change request but apply the patch before waiting for approval.
    3. Thomas should work through the standard change approval process and wait until it is complete to apply the patch.
    4. Thomas should file an emergency change request and wait until it is approved to apply the patch.
  154. After running a vulnerability scan of systems in his organization's development shop, Mike discovers the issue shown here on several systems. What is the best solution to this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Apply the required security patches to this framework.
    2. Remove this framework from the affected systems.
    3. Upgrade the operating system of the affected systems.
    4. No action is necessary.
  155. Tran is preparing to conduct vulnerability scans against a set of workstations in his organization. He is particularly concerned about system configuration settings. Which one of the following scan types will give him the best results?
    1. Unauthenticated scan
    2. Credentialed scan
    3. External scan
    4. Internal scan
  156. Brian is configuring a vulnerability scan of all servers in his organization's datacenter. He is configuring the scan to detect only the highest-severity vulnerabilities. He would like to empower system administrators to correct issues on their servers but also have some insight into the status of those remediations. Which approach would best serve Brian's interests?
    1. Give the administrators access to view the scans in the vulnerability scanning system.
    2. Send email alerts to administrators when the scans detect a new vulnerability on their servers.
    3. Configure the vulnerability scanner to open a trouble ticket when they detect a new vulnerability on a server.
    4. Configure the scanner to send reports to Brian who can notify administrators and track them in a spreadsheet.
  157. Xiu Ying is configuring a new vulnerability scanner for use in her organization's datacenter. Which one of the following values is considered a best practice for the scanner's update frequency?
    1. Daily
    2. Weekly
    3. Monthly
    4. Quarterly
  158. Ben’s manager recently assigned him to begin the remediation work on the most vulnerable server in his organization. A portion of the scan report appears here. What remediation action should Ben take first?
    1. Install patches for Adobe Flash.
    2. Install patches for Firefox.
    3. Run Windows Update.
    4. Remove obsolete software.

    A window page depicts the data on vulnerabilities.
  159. Zhang Wei completed a vulnerability scan of his organization's virtualization platform from an external host and discovered the vulnerability shown here. How should he react?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. This is a critical issue that requires immediate adjustment of firewall rules.
    2. This issue has a very low severity and does not require remediation.
    3. This issue should be corrected as time permits.
    4. This is a critical issue, and Zhang Wei should shut down the platform until it is corrected.
  160. Elliott runs a vulnerability scan of one of the servers belonging to his organization and finds the results shown here. Which one of these statements is not correct?
    A window page depicts the data on vulnerabilities.
    1. This server requires one or more Linux patches.
    2. This server requires one or more Oracle database patches.
    3. This server requires one or more Firefox patches.
    4. This server requires one or more MySQL patches.
  161. Tom runs a vulnerability scan of the file server shown here.
    A system architecture. It involves internet, firewall, internal network, workstation, file server, web server, screened subnet, and email server.

    He receives the vulnerability report shown next. Assuming that the firewall is configured properly, what action should Tom take immediately?

    A window page depicts the data on vulnerabilities.
    1. Block RDP access to this server from all hosts.
    2. Review and secure server accounts.
    3. Upgrade encryption on the server.
    4. No action is required.
  162. Dave is running a vulnerability scan of a client's network for the first time. The client has never run such a scan and expects to find many results. What security control is likely to remediate the largest portion of the vulnerabilities discovered in Dave's scan?
    1. Input validation
    2. Patching
    3. Intrusion prevention systems
    4. Encryption
  163. Kai is planning to patch a production system to correct a vulnerability detected during a scan. What process should she follow to correct the vulnerability but minimize the risk of a system failure?
    1. Kai should deploy the patch immediately on the production system.
    2. Kai should wait 60 days to deploy the patch to determine whether bugs are reported.
    3. Kai should deploy the patch in a sandbox environment to test it prior to applying it in production.
    4. Kai should contact the vendor to determine a safe timeframe for deploying the patch in production.
  164. Given no other information, which one of the following vulnerabilities would you consider the greatest threat to information confidentiality?
    1. HTTP TRACE/TRACK methods enabled
    2. SSL Server with SSL v3 enabled vulnerability
    3. phpinfo information disclosure vulnerability
    4. Web application SQL injection vulnerability
  165. Ling recently completed the security analysis of a web browser deployed on systems in her organization and discovered that it is susceptible to a zero-day integer overflow attack. Who is in the best position to remediate this vulnerability in a manner that allows continued use of the browser?
    1. Ling
    2. The browser developer
    3. The network administrator
    4. The domain administrator
  166. Jeff's team is preparing to deploy a new database service, and he runs a vulnerability scan of the test environment. This scan results in the four vulnerability reports shown here. Jeff is primarily concerned with correcting issues that may lead to a confidentiality breach. Which vulnerability should Jeff remediate first?
    A window page depicts the data on vulnerabilities.
    1. Rational ClearCase Portscan Denial of Service vulnerability
    2. Non-Zero Padding Bytes Observed in Ethernet Packets
    3. Oracle Database TNS Listener Poison Attack vulnerability
    4. Hidden RPC Services
  167. Eric is a security consultant and is trying to sell his services to a new client. He would like to run a vulnerability scan of their network prior to their initial meeting to show the client the need for added security. What is the most significant problem with this approach?
    1. Eric does not know the client's infrastructure design.
    2. Eric does not have permission to perform the scan.
    3. Eric does not know what operating systems and applications are in use.
    4. Eric does not know the IP range of the client's systems.
  168. Renee is assessing the exposure of her organization to the denial-of-service vulnerability in the scan report shown here. She is specifically interested in determining whether an external attacker would be able to exploit the denial-of-service vulnerability. Which one of the following sources of information would provide her with the best information to complete this assessment?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Server logs
    2. Firewall rules
    3. IDS configuration
    4. DLP configuration
  169. Mary is trying to determine what systems in her organization should be subject to vulnerability scanning. She would like to base this decision on the criticality of the system to business operations. Where should Mary turn to best find this information?
    1. The CEO
    2. System names
    3. IP addresses
    4. Asset inventory
  170. Paul ran a vulnerability scan of his vulnerability scanner and received the result shown here. What is the simplest fix to this issue?
    A window page depicts the result of nessus.
    1. Upgrade Nessus.
    2. Remove guest accounts.
    3. Implement TLS encryption.
    4. Renew the server certificate.
  171. Kamea is designing a vulnerability management system for her organization. Her highest priority is conserving network bandwidth. She does not have the ability to alter the configuration or applications installed on target systems. What solution would work best in Kamea's environment to provide vulnerability reports?
    1. Agent-based scanning
    2. Server-based scanning
    3. Passive network monitoring
    4. Port scanning
  172. Aki is conducting a vulnerability scan when he receives a report that the scan is slowing down the network for other users. He looks at the performance configuration settings shown here. Which setting would be most likely to correct the issue?
    A window page depicts the general settings and the performance options.
    1. Enable safe checks.
    2. Stop scanning hosts that become unresponsive during the scan.
    3. Scan IP addresses in random order.
    4. Max simultaneous hosts per scan.
  173. Laura received a vendor security bulletin that describes a zero-day vulnerability in her organization's main database server. This server is on a private network but is used by publicly accessible web applications. The vulnerability allows the decryption of administrative connections to the server. What reasonable action can Laura take to address this issue as quickly as possible?
    1. Apply a vendor patch that resolves the issue.
    2. Disable all administrative access to the database server.
    3. Require VPN access for remote connections to the database server.
    4. Verify that the web applications use strong encryption.
  174. Emily discovered the vulnerability shown here on a server running in her organization. What is the most likely underlying cause for this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Failure to perform input validation
    2. Failure to use strong passwords
    3. Failure to encrypt communications
    4. Failure to install antimalware software
  175. Rex recently ran a vulnerability scan of his organization's network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list?
    A window page presents a dashboard that exposes the most vulnerable hosts details.
    1. 10.0.102.58
    2. 10.0.16.58
    3. 10.0.46.116
    4. 10.0.69.232
  176. Abella is configuring a vulnerability scanning tool. She recently learned about a privilege escalation vulnerability that requires the user already have local access to the system. She would like to ensure that her scanners are able to detect this vulnerability as well as future similar vulnerabilities. What action can she take that would best improve the scanner's ability to detect this type of issue?
    1. Enable credentialed scanning.
    2. Run a manual vulnerability feed update.
    3. Increase scanning frequency.
    4. Change the organization's risk appetite.
  177. Kylie reviewed the vulnerability scan report for a web server and found that it has multiple SQL injection and cross-site scripting vulnerabilities. What would be the least difficult way for Kylie to address these issues?
    1. Install a web application firewall.
    2. Recode the web application to include input validation.
    3. Apply security patches to the server operating system.
    4. Apply security patches to the web server service.
  178. Karen ran a vulnerability scan of a web server used on her organization's internal network. She received the report shown here. What circumstances would lead Karen to dismiss this vulnerability as a false positive?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. The server is running SSL v2.
    2. The server is running SSL v3.
    3. The server is for internal use only.
    4. The server does not contain sensitive information.
  179. Which one of the following vulnerabilities is the most difficult to confirm with an external vulnerability scan?
    1. Cross-site scripting
    2. Cross-site request forgery
    3. Blind SQL injection
    4. Unpatched web server
  180. Holly ran a scan of a server in her datacenter, and the most serious result was the vulnerability shown here. What action is most commonly taken to remediate this vulnerability?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. Remove the file from the server.
    2. Edit the file to limit information disclosure.
    3. Password protect the file.
    4. Limit file access to a specific IP range.
  181. During a recent vulnerability scan, Mark discovered a flaw in an internal web application that allows cross-site scripting attacks. He spoke with the manager of the team responsible for that application and was informed that he discovered a known vulnerability and the manager worked with other leaders and determined that the risk is acceptable and does not require remediation. What should Mark do?
    1. Object to the manager's approach and insist on remediation.
    2. Mark the vulnerability as a false positive.
    3. Schedule the vulnerability for remediation in six months.
    4. Mark the vulnerability as an exception.
  182. Jacquelyn recently read about a new vulnerability in Apache web servers that allows attackers to execute arbitrary code from a remote location. She verified that her servers have this vulnerability, but this morning's OpenVAS vulnerability scan report shows that the servers are secure. She contacted the vendor and determined that they have released a signature for this vulnerability and it is working properly at other clients. What action can Jacquelyn take that will most likely address the problem efficiently?
    1. Add the web servers to the scan.
    2. Reboot the vulnerability scanner.
    3. Update the vulnerability feed.
    4. Wait until tomorrow's scan.
  183. Sharon is designing a new vulnerability scanning system for her organization. She must scan a network that contains hundreds of unmanaged hosts. Which of the following techniques would be most effective at detecting system configuration issues in her environment?
    1. Agent-based scanning
    2. Credentialed scanning
    3. Server-based scanning
    4. Passive network monitoring

    Use the following scenario to answer questions 184–186.

    Arlene ran a vulnerability scan of a VPN server used by contractors and employees to gain access to her organization's network. An external scan of the server found the vulnerability shown here.

    A window page presents the SSL certificate signed using weak hashing algorithm.
  184. Which one of the following hash algorithms would not trigger this vulnerability?
    1. MD4
    2. MD5
    3. SHA-1
    4. SHA-256
  185. What is the most likely result of failing to correct this vulnerability?
    1. All users will be able to access the site.
    2. All users will be able to access the site, but some may see an error message.
    3. Some users will be unable to access the site.
    4. All users will be unable to access the site.
  186. How can Arlene correct this vulnerability?
    1. Reconfigure the VPN server to only use secure hash functions.
    2. Request a new certificate.
    3. Change the domain name of the server.
    4. Implement an intrusion prevention system.
  187. After reviewing the results of a vulnerability scan, Bruce discovered that many of the servers in his organization are susceptible to a brute-force SSH attack. He would like to determine what external hosts attempted SSH connections to his servers and is reviewing firewall logs. What TCP port would relevant traffic most likely use?
    1. 22
    2. 636
    3. 1433
    4. 1521
  188. Joaquin runs a vulnerability scan of the network devices in his organization and sees the vulnerability report shown here for one of those devices. What action should he take?
    A window page presents the first detected, last detected, time detected, and last fixed data.
    1. No action is necessary because this is an informational report.
    2. Upgrade the version of the certificate.
    3. Replace the certificate.
    4. Verify that the correct ciphers are being used.
  189. Lori is studying vulnerability scanning as she prepares for the CySA+ exam. Which of the following is not one of the principles she should observe when preparing for the exam to avoid causing issues for her organization?
    1. Run only nondangerous scans on production systems to avoid disrupting a production service.
    2. Run scans in a quiet manner without alerting other IT staff to the scans or their results to minimize the impact of false information.
    3. Limit the bandwidth consumed by scans to avoid overwhelming an active network link.
    4. Run scans outside of periods of critical activity to avoid disrupting the business.
  190. Meredith is configuring a vulnerability scan and would like to configure the scanner to perform credentialed scans. Of the menu options shown here, which will allow her to directly configure this capability?
    A window page depicts the manage vulnerability scans, manage discovery scans, configure scan settings, configure search lists, configure scan schedules, configure scanner appliances, and setup host authentication options.
    1. Manage Discovery Scans
    2. Configure Scan Settings
    3. Configure Search Lists
    4. Set Up Host Authentication
  191. Norman is working with his manager to implement a vulnerability management program for his company. His manager tells him that he should focus on remediating critical and high-severity risks and that the organization does not want to spend time worrying about risks rated medium or lower. What type of criteria is Norman's manager using to make this decision?
    1. Risk appetite
    2. False positive
    3. False negative
    4. Data classification
  192. Sara's organization has a well-managed test environment. What is the most likely issue that Sara will face when attempting to evaluate the impact of a vulnerability remediation by first deploying it in the test environment?
    1. Test systems are not available for all production systems.
    2. Production systems require a different type of patch than test systems.
    3. Significant configuration differences exist between test and production systems.
    4. Test systems are running different operating systems than production systems.
  193. How many vulnerabilities listed in the report shown here are significant enough to warrant immediate remediation in a typical operating environment?
    A window page depicts the data on vulnerabilities.
    1. 22
    2. 14
    3. 5
    4. 0
  194. Which one of the following types of data is subject to regulations in the United States that specify the minimum frequency of vulnerability scanning?
    1. Driver's license numbers
    2. Insurance records
    3. Credit card data
    4. Medical records
  195. Chang is responsible for managing his organization's vulnerability scanning program. He is experiencing issues with scans aborting because the previous day's scans are still running when the scanner attempts to start the current day's scans. Which one of the following solutions is least likely to resolve Chang's issue?
    1. Add a new scanner.
    2. Reduce the scope of the scans.
    3. Reduce the sensitivity of the scans.
    4. Reduce the frequency of the scans.
  196. Bhanu is scheduling vulnerability scans for her organization's datacenter. Which one of the following is a best practice that Bhanu should follow when scheduling scans?
    1. Schedule scans so that they are spread evenly throughout the day.
    2. Schedule scans so that they run during periods of low activity.
    3. Schedule scans so that they all begin at the same time.
    4. Schedule scans so that they run during periods of peak activity to simulate performance under load.
  197. Alan recently reviewed a vulnerability report and determined that an insecure direct object reference vulnerability existed on the system. He implemented a remediation to correct the vulnerability. After doing so, he verifies that his actions correctly mitigated the vulnerability. What term best describes the initial vulnerability report?
    1. True positive
    2. True negative
    3. False positive
    4. False negative
  198. Gwen is reviewing a vulnerability report and discovers that an internal system contains a serious flaw. After reviewing the issue with her manager, they decide that the system is sufficiently isolated and they will take no further action. What risk management strategy are they adopting?
    1. Risk avoidance
    2. Risk mitigation
    3. Risk transference
    4. Risk acceptance

    Use the following scenario for questions 199–201.

    Mike is in charge of the software testing process for his company. They perform a complete set of tests for each product throughout its life span. Use your knowledge of software assessment methods to answer the following questions.

  199. A new web application has been written by the development team in Mike's company. They used an Agile process and built a tool that fits all of the user stories that the participants from the division that asked for the application outlined. If they want to ensure that the functionality is appropriate for all users in the division, what type of testing should Mike perform?
    1. Stress testing
    2. Regression testing
    3. Static testing
    4. User acceptance testing
  200. Mike's development team wants to expand the use of the software to the whole company, but they are concerned about its performance. What type of testing should they conduct to ensure that the software will not fail under load?
    1. Stress testing
    2. Regression testing
    3. Static testing
    4. User acceptance testing
  201. Two years after deployment, Mike's team is ready to roll out a major upgrade to their web application. They have pulled code from the repository that it was checked into but are worried that old bugs may have been reintroduced because they restored additional functionality based on older code that had been removed in a release a year ago. What type of testing does Mike's team need to perform?
    1. Stress testing
    2. Regression testing
    3. Static testing
    4. User acceptance testing
  202. Padma is evaluating the security of an application developed within her organization. She would like to assess the application's security by supplying it with invalid inputs. What technique is Padma planning to use?
    1. Fault injection
    2. Stress testing
    3. Mutation testing
    4. Fuzz testing
  203. Which software development life cycle model is illustrated in the image?
    A software development life cycle model with 2 sprints.
    1. Waterfall
    2. Spiral
    3. Agile
    4. RAD
  204. The Open Worldwide Application Security Project (OWASP) maintains an application called Orizon. This application reviews Java classes and identifies potential security flaws. What type of tool is Orizon?
    1. Fuzzer
    2. Static code analyzer
    3. Web application assessor
    4. Fault injector
  205. Barney's organization mandates fuzz testing for all applications before deploying them into production. Which one of the following issues is this testing methodology most likely to detect?
    1. Incorrect firewall rules
    2. Unvalidated input
    3. Missing operating system patches
    4. Unencrypted data transmission
  206. Mia would like to ensure that her organization's cybersecurity team reviews the architecture of a new ERP application that is under development. During which SDLC phase should Mia expect the security architecture to be completed?
    1. Analysis and Requirements Definition
    2. Design
    3. Development
    4. Testing and Integration
  207. Which one of the following security activities is not normally a component of the Operations and Maintenance phase of the SDLC?
    1. Vulnerability scans
    2. Disposition
    3. Patching
    4. Regression testing

    Use the following scenario for questions 208–210.

    Olivia has been put in charge of performing code reviews for her organization and needs to determine which code analysis models make the most sense based on specific needs her organization has. Use your knowledge of code analysis techniques to answer the following questions.

  208. Olivia's security team has identified potential malicious code that has been uploaded to a webserver. If she wants to review the code without running it, what technique should she use?
    1. Dynamic analysis
    2. Fagan analysis
    3. Regression analysis
    4. Static analysis
  209. Olivia's next task is to test the code for a new mobile application. She needs to test it by executing the code and intends to provide the application with input based on testing scenarios created by the development team as part of their design work. What type of testing will Olivia conduct?
    1. Dynamic analysis
    2. Fagan analysis
    3. Regression analysis
    4. Static analysis
  210. After completing the first round of tests for her organization's mobile application, Olivia has discovered indications that the application may not handle unexpected data well. What type of testing should she conduct if she wants to test it using an automated tool that will check for this issue?
    1. Fault injection
    2. Fagan testing
    3. Fuzzing
    4. Failure injection
  211. Which one of the following characters would not signal a potential security issue during the validation of user input to a web application?
    1. <
    2. '
    3. >
    4. $
  212. The Open Worldwide Application Security Project (OWASP) maintains a listing of the most important web application security controls. Which one of these items is least likely to appear on that list?
    1. Implement identity and authentication controls.
    2. Implement appropriate access controls.
    3. Obscure web interface locations.
    4. Leverage security frameworks and libraries.
  213. Kyle is developing a web application that uses a database back end. He is concerned about the possibility of an SQL injection attack against his application and is consulting the OWASP proactive security controls list to identify appropriate controls. Which one of the following OWASP controls is least likely to prevent a SQL injection attack?
    1. Parameterize queries.
    2. Validate all input.
    3. Encode data.
    4. Implement logging and intrusion detection.
  214. Jill's organization has adopted an asset management tool. If she wants to identify systems on the network based on a unique identifier per machine that will not normally change over time, which of the following options can she use for network-based discovery?
    1. IP address
    2. Hostname
    3. MAC address
    4. None of the above
  215. Which software development methodology is illustrated in the diagram?
    A software development methodology.
    1. Spiral
    2. RAD
    3. Agile
    4. Waterfall
  216. Claire knows that a web application that her organization needs to have in production has vulnerabilities due to a recent scan using a web application security scanner. What is her best protection option if she knows that the vulnerability is a known SQL injection flaw?
    1. A firewall
    2. An IDS
    3. A WAF
    4. DLP

    Use the following scenario to answer questions 217–219.

    Donna has been assigned as the security lead for a DevSecOps team building a new web application. As part of the effort, she has to oversee the security practices that the team will use to protect the application. Use your knowledge of secure coding practices to help Donna guide her team through this process.

  217. A member of Donna's team recommends building a blocklist to avoid dangerous characters like ' and <script> tags. How could attackers bypass a blocklist that individually identified those characters?
    1. They can use a binary attack.
    2. They can use alternate encodings.
    3. They can use different characters with the same meaning.
    4. The characters could be used together to avoid the blocklist.
  218. The design of the application calls for client-side validation of input. What type of tool could an attacker use to bypass this?
    1. An XSS injector
    2. A web proxy
    3. A JSON interpreter
    4. A SQL injector
  219. A member of Donna's security team suggests that output encoding should also be considered. What type of attack is the team member most likely attempting to prevent?
    1. Cross-site scripting
    2. SQL injection
    3. Cross-site request forgery
    4. All of the above
  220. Nathan downloads a BIOS/UEFI update from Dell's website, and when he attempts to install it on the PC, he receives an error that the hash of the download does not match the hash stored on Dell's servers. What type of protection is this?
    1. Full-disk encryption
    2. Firmware protection
    3. Operating system protection
    4. None of the above
  221. What practice is typical in a DevSecOps organization as part of a CI/CD pipeline?
    1. Automating some security gates
    2. Programmatic implementation of zero-day vulnerabilities
    3. Using security practitioners to control the flow of the CI/CD pipeline
    4. Removing security features from the IDE
  222. Valerie wants to prevent potential cross-site scripting attacks from being executed when previously entered information is displayed in user's browsers. What technique should she use to prevent this?
    1. A firewall
    2. A HIDS
    3. Output encoding
    4. String randomization
  223. While developing a web application, Chris sets his session ID length to 128 bits based on OWASP's recommended session management standards. What reason would he have for needing such a long session ID?
    1. To avoid duplication
    2. To allow for a large group of users
    3. To prevent brute-forcing
    4. All of the above
  224. Robert is reviewing a web application, and the developers have offered four different responses to incorrect logins. Which of the following four responses is the most secure option?
    1. Login failed for user; invalid password
    2. Login failed; invalid user ID or password
    3. Login failed; invalid user ID
    4. Login failed; account does not exist
  225. Nathan is reviewing PHP code for his organization and finds the following code in the application he is assessing. What technique is the developer using? 
    $stmt = $dbh->prepare(“INSERT INTO REGISTRY (var1, var2) VALUES (:var1, :var2)”);
$stmt->bindParam(‘:var1’, $var1);
$stmt->bindParam(‘:var2’, $var2);
    1. Dynamic binding
    2. Parameterized queries
    3. Variable limitation
    4. None of the above
  226. Christina wants to check the firmware she has been provided to ensure that it is the same firmware that the manufacturer provides. What process should she follow to validate that the firmware is trusted firmware?
    1. Download the same file from the manufacturer and compare file size.
    2. Compare a hash of the file to a hash provided by the manufacturer.
    3. Run strings against the firmware to find any evidence of tempering.
    4. Submit the firmware to a malware scanning site to verify that it does not contain malware.
  227. What type of attack is the use of query parameterization intended to prevent?
    1. Buffer overflows
    2. Cross-site scripting
    3. SQL injection
    4. Denial-of-service attacks
  228. What type of attack is output encoding typically used against?
    1. DoS
    2. XSS
    3. XML
    4. DDoS

    Use the following scenario for questions 229–231.

    Scott has been asked to select a software development model for his organization and knows that there are a number of models that may make sense for what he has been asked to accomplish. Use your knowledge of SDLC models to identify an appropriate model for each of the following requirements.

  229. Scott's organization needs basic functionality of the effort to become available as soon as possible and wants to involve the teams that will use it heavily to ensure that their needs are met. What model should Scott recommend?
    1. Waterfall
    2. Spiral
    3. Agile
    4. Rapid Application Development
  230. A parallel coding effort needs to occur; however, this effort involves a very complex system and errors could endanger human lives. The system involves medical records and drug dosages, and the organization values stability and accuracy over speed. Scott knows the organization often adds design constraints throughout the process and that the model he selects must also deal with that need. What model should he choose?
    1. Waterfall
    2. Spiral
    3. Agile
    4. Rapid Application Development
  231. At the end of his development cycle, what SDLC phase will Scott enter as the new application is installed and replaces the old code?
    1. User acceptance testing
    2. Testing and integration
    3. Disposition
    4. Redesign
  232. The OWASP Session Management Cheatsheet advises that session IDs are meaningless and recommends that they should be used only as an identifier on the client side. Why should a session ID not have additional information encoded in it like the IP address of the client, their username, or other information?
    1. Processing complex session IDs will slow down the service.
    2. Session IDs cannot contain this information for legal reasons.
    3. Session IDs are sent to multiple different users, which would result in a data breach.
    4. Session IDs could be decoded, resulting in data leakage.
  233. Bounds checking, removing special characters, and forcing strings to match a limited set of options are all examples of what web application security technique?
    1. SQL injection prevention
    2. Input validation
    3. XSS prevention
    4. Fuzzing
  234. Abigail is performing input validation against an input field and uses the following regular expression: 
    ^(AA|AE|AP|AL|AK|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|
HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MT|NE|
NV|NH|NJ|NM|NY|NC|ND|MP|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|
TX|UT|VT|VI|VA|WA|WV|WI|WY)$

    What is she checking with the regular expression?

    1. She is removing all typical special characters found in SQL injection.
    2. She is checking for all U.S. state names.
    3. She is removing all typical special characters for cross-site scripting attacks.
    4. She is checking for all U.S. state name abbreviations.
  235. Jennifer uses an application to send randomized data to her application to determine how it responds to unexpected input. What type of tool is she using?
    1. A UAT tool
    2. A stress testing tool
    3. A fuzzer
    4. A regression testing tool
  236. Greg wants to prevent SQL injection in a web application he is responsible for. Which of the following is not a common defense against SQL injection?
    1. Prepared statements with parameterized queries
    2. Output validation
    3. Stored procedures
    4. Escaping all user-supplied input
  237. While reviewing code that generates a SQL query, Aarav notices that the “address” field is appended to the query without input validation or other techniques applied. What type of attack is most likely to be successful against code like this?
    1. DoS
    2. XSS
    3. SQL injection
    4. Teardrop

    Use the following diagram and scenario for questions 238–240.

    Amanda has been assigned to lead the development of a new web application for her organization. She is following a standard SDLC model as shown here. Use the model and your knowledge of the software development life cycle to answer the following questions.

    An illustration of a standard SDLC model.
  238. Amanda's first task is to determine if there are alternative solutions that are more cost effective than in-house development. What phase is she in?
    1. Design
    2. Operations and maintenance
    3. Feasibility
    4. Analysis and requirements definition
  239. What phase of the SDLC typically includes the first code analysis and unit testing in the process?
    1. Analysis and requirements definition
    2. Design
    3. Coding
    4. Testing and integration
  240. After making it through most of the SDLC process, Amanda has reached point E on the diagram. What occurs at point E?
    1. Disposition
    2. Training and transition
    3. Unit testing
    4. Testing and integration
  241. Angela wants to prevent buffer overflow attacks on a Windows system. What two built-in technologies should she consider?
    1. The memory firewall and the stack guard
    2. ASLR and DEP
    3. ASLR and DLP
    4. The memory firewall and the buffer guard
  242. Amanda has been assigned to reduce the attack surface area for her organization, and she knows that the current network design relies on allowing systems throughout her organization to access the Internet directly via public IP addresses they are assigned. What should her first step be to reduce her organization's attack surface quickly and without large amounts of time invested?
    1. Install host firewalls on the systems.
    2. Move to a NAT environment.
    3. Install an IPS.
    4. None of the above.
  243. Matt believes that developers in his organization deployed code that did not implement cookies in a secure way. What type of attack would be aided by this security issue?
    1. SQL injection
    2. A denial-of-service attack
    3. Session hijacking
    4. XSS
  244. Chris operates the point-of-sale (POS) network for a company that accepts credit cards and is thus required to be compliant with PCI DSS. During his regular assessment of the POS terminals, he discovers that a recent Windows operating system vulnerability exists on all of them. Since they are all embedded systems that require a manufacturer update, he knows that he cannot install the available patch. What is Chris's best option to stay compliant with PCI DSS and protect his vulnerable systems?
    1. Replace the Windows embedded point-of-sale terminals with standard Windows systems.
    2. Build a custom operating system image that includes the patch.
    3. Identify, implement, and document compensating controls.
    4. Remove the POS terminals from the network until the vendor releases a patch.
  245. Tracy is validating the web application security controls used by her organization. She wants to ensure that the organization is prepared to conduct forensic investigations of future security incidents. Which one of the following OWASP control categories is most likely to contribute to this effort?
    1. Implement logging.
    2. Validate all inputs.
    3. Parameterize queries.
    4. Error and exception handling.
  246. While reviewing his Apache logs, Oscar discovers the following entry. What has occurred? 
    10.1.1.1 - - [27/Jun/2023:11:42:22 -0500] "GET
/query.php?searchterm=stuff&%20lid=1%20UNION%20SELECT%200,
username,user_id,password,name,%20email,%20FROM%20users
HTTP/1.1" 200 9918 "-" "Mozilla/4.0 (compatible; MSIE 6.0;
Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
    1. A successful database query
    2. A PHP overflow attack
    3. A SQL injection attack
    4. An unsuccessful database query
  247. Joan is working as a security consultant to a company that runs a critical web application. She discovered that the application has a serious SQL injection vulnerability, but the company cannot take the system offline during the two weeks required to revise the code. Which one of the following technologies would serve as the best compensating control?
    1. IPS
    2. WAF
    3. Vulnerability scanning
    4. Encryption
  248. After conducting an nmap scan of his network from outside of his network, James notes that a large number of devices are showing three TCP ports open on public IP addresses: 9100, 515, and 631. What type of devices has he found, and how could he reduce his organization's attack surface?
    1. Wireless access points, disable remote administration
    2. Desktop workstations, enable the host firewall
    3. Printers, move the printers to an internal-only IP address range
    4. Network switches, enable encrypted administration mode
  249. Alex is working to understand his organization's attack surface. Services, input fields in a web application, and communication protocols are all examples of what component of an attack surface evaluation?
    1. Threats
    2. Attack vectors
    3. Risks
    4. Surface tension
  250. Michelle wants to implement a static application security testing (SAST) tool into her continuous integration pipeline. What challenge could she run into if her organization uses multiple programming languages for components of their application stack that will be tested?
    1. They will have to ensure the scanner works with all of the languages chosen.
    2. They will have to compile all of the code to the same binary output language.
    3. They will have to run the applications in a sandbox.
    4. They will have to run the applications under the same execution environment.
  251. Ken learns that an APT group is targeting his organization. What term best describes this situation?
    1. Risk
    2. Threat
    3. Countermeasure
    4. Vulnerability
  252. Which one of the following activities is least likely to occur during the risk identification process?
    1. Network segmentation
    2. Threat intelligence
    3. Vulnerability scanning
    4. System assessments
  253. What two factors are weighted most heavily when determining the severity of a risk?
    1. Probability and magnitude
    2. Likelihood and probability
    3. Magnitude and impact
    4. Impact and control
  254. Preemployment background screening is an example of what type of security control?
    1. Detective
    2. Preventive
    3. Corrective
    4. Compensating
  255. Roland received a security assessment report from a third-party assessor, and it indicated that one of the organization's web applications is susceptible to an OAuth redirect attack. What type of attack would this vulnerability allow an attacker to wage?
    1. Privilege escalation
    2. Cross-site scripting
    3. SQL injection
    4. Impersonation

    Questions 256–258 refer to the following scenario.

    Gary recently conducted a comprehensive security review of his organization. He identified the 25 top risks to the organization and is pursuing different risk management strategies for each of these risks. In some cases, he is using multiple strategies to address a single risk. His goal is to reduce the overall level of risk so that it lies within his organization's risk tolerance.

  256. Gary decides that the organization should integrate a threat intelligence feed with the firewall. What type of risk management strategy is this?
    1. Risk mitigation
    2. Risk acceptance
    3. Risk transference
    4. Risk avoidance
  257. Gary discovers that his organization is storing some old files in a cloud service that are exposed to the world. He deletes those files. What type of risk management strategy is this?
    1. Risk mitigation
    2. Risk acceptance
    3. Risk transference
    4. Risk avoidance
  258. Gary is working with his financial team to purchase a cyber-liability insurance policy to cover the financial impact of a data breach. What type of risk management strategy is he using?
    1. Risk mitigation
    2. Risk acceptance
    3. Risk transference
    4. Risk avoidance
  259. Which one of the following risk management strategies is most likely to limit the probability of a risk occurring?
    1. Risk acceptance
    2. Risk avoidance
    3. Risk transference
    4. Risk mitigation
  260. Saanvi would like to reduce the probability of a data breach that affects sensitive personal information. Which one of the following compensating controls is most likely to achieve that objective?
    1. Minimizing the amount of data retained and the number of places where it is stored
    2. Limiting the purposes for which data may be used
    3. Purchasing cyber-risk insurance
    4. Installing a new firewall
  261. Kwame recently completed a risk assessment and is concerned that the level of residual risk exceeds his organization's risk tolerance. What should he do next?
    1. Have a discussion with his manager.
    2. Implement new security controls.
    3. Modify business processes to lower risk.
    4. Purge data from systems.

    Questions 262–267 refer to the following scenario.

    Alan is a risk manager for Acme University, a higher education institution located in the western United States. He is concerned about the threat that an earthquake will damage his organization's primary datacenter. He recently undertook a replacement cost analysis and determined that the datacenter is valued at $10 million.

    After consulting with seismologists, Alan determined that an earthquake is expected in the area of the datacenter once every 200 years. Datacenter specialists and architects helped him determine that an earthquake would likely cause $5 million in damage to the facility.

  262. Based on the information in this scenario, what is the exposure factor (EF) for the effect of an earthquake on Acme University's datacenter?
    1. 10 percent
    2. 25 percent
    3. 50 percent
    4. 75 percent
  263. Based on the information in this scenario, what is the annualized rate of occurrence (ARO) for an earthquake at the datacenter?
    1. .0025
    2. .005
    3. .01
    4. .015
  264. Based on the information in this scenario, what is the annualized loss expectancy (ALE) for an earthquake at the datacenter?
    1. $25,000
    2. $50,000
    3. $250,000
    4. $500,000
  265. Referring to the previous scenario, if Alan's organization decides to move the datacenter to a location where earthquakes are not a risk, what risk management strategy are they using?
    1. Risk mitigation
    2. Risk avoidance
    3. Risk acceptance
    4. Risk transference
  266. Referring to the previous scenario, if the organization decides not to relocate the datacenter but instead purchases an insurance policy to cover the replacement cost of the datacenter, what risk management strategy are they using?
    1. Risk mitigation
    2. Risk avoidance
    3. Risk acceptance
    4. Risk transference
  267. Referring to the previous scenario, assume that the organization decides that relocation is too difficult and the insurance is too expensive. They instead decide that they will carry on despite the risk of earthquake and handle the impact if it occurs. What risk management strategy are they using?
    1. Risk mitigation
    2. Risk avoidance
    3. Risk acceptance
    4. Risk transference
  268. Colin would like to implement a detective security control in his accounting department, which is specifically designed to identify cases of fraud that are able to occur despite the presence of other security controls. Which one of the following controls is best suited to meet Colin's need?
    1. Separation of duties
    2. Least privilege
    3. Dual control
    4. Mandatory vacations
  269. Rob is an auditor reviewing the managerial controls used in an organization. He is examining the payment process used by the company to issue checks to vendors. He notices that Helen, a staff accountant, is the person responsible for creating new vendors. Norm, another accountant, is responsible for issuing payments to vendors. Helen and Norm are cross-trained to provide backup for each other. What security issue, if any, exists in this situation?
    1. Least privilege violation
    2. Separation of duties violation
    3. Dual control violation
    4. No issue
  270. Mei recently completed a risk management review and identified that the organization is susceptible to an on-path (also known as man-in-the-middle) attack. After review with her manager, they jointly decided that accepting the risk is the most appropriate strategy. What should Mei do next?
    1. Implement additional security controls.
    2. Design a remediation plan.
    3. Repeat the business impact assessment.
    4. Document the decision.
  271. Robin is planning to conduct a risk assessment in her organization. She is concerned that it will be difficult to perform the assessment because she needs to include information about both tangible and intangible assets. What would be the most effective risk assessment strategy for her to use?
    1. Quantitative risk assessment
    2. Qualitative risk assessment
    3. Combination of quantitative and qualitative risk assessment
    4. Neither quantitative nor qualitative risk assessment
  272. Barry's organization is running a security exercise and Barry was assigned to conduct offensive operations. What term best describes Barry's role in the process?
    1. Red team
    2. Purple team
    3. Blue team
    4. White team
  273. Vlad's organization recently underwent a security audit that resulted in a finding that the organization fails to promptly remove the accounts associated with users who have left the organization. This resulted in at least one security incident where a terminated user logged into a corporate system and took sensitive information. What identity and access management control would best protect against this risk?
    1. Automated deprovisioning
    2. Quarterly user account reviews
    3. Separation of duties
    4. Two-person control
  274. Jay is the CISO for his organization and is responsible for conducting periodic reviews of the organization's information security policy. The policy was written three years ago and has undergone several minor revisions after audits and assessments. Which one of the following would be the most reasonable frequency to conduct formal reviews of the policy?
    1. Monthly
    2. Quarterly
    3. Annually
    4. Every five years
  275. Terri is undertaking a risk assessment for her organization. Which one of the following activities would normally occur first?
    1. Risk identification
    2. Risk calculation
    3. Risk mitigation
    4. Risk management
  276. Kai is attempting to determine whether he can destroy a cache of old records that he discovered. What type of policy would most directly answer his question?
    1. Data ownership
    2. Data classification
    3. Data minimization
    4. Data retention
  277. Fences are a widely used security control that can be described by several different control types. Which one of the following control types would least describe a fence?
    1. Deterrent
    2. Corrective
    3. Preventive
    4. Physical
  278. Ian is designing an authorization scheme for his organization's deployment of a new accounting system. He is considering putting a control in place that would require that two accountants approve any payment request over $100,000. What security principle is Ian seeking to enforce?
    1. Security through obscurity
    2. Least privilege
    3. Separation of duties
    4. Dual control
  279. Carmen is working with a new vendor on the design of a penetration test. She would like to ensure that the vendor does not conduct any physical intrusions as part of their testing. Where should Carmen document this requirement?
    1. Rules of engagement
    2. Service level objectives
    3. Nondisclosure agreement
    4. Counterparty agreement
  280. Gavin is drafting a document that provides a detailed step-by-step process that users may follow to connect to the VPN from remote locations. Alternatively, users may ask IT to help them configure the connection. What term best describes this document?
    1. Policy
    2. Procedure
    3. Standard
    4. Guideline
  281. Which one of the following security controls is designed to help provide continuity for security responsibilities?
    1. Succession planning
    2. Separation of duties
    3. Mandatory vacation
    4. Dual control
  282. After conducting a security review, Oskar determined that his organization is not conducting regular backups of critical data. What term best describes the type of control gap that exists in Oskar's organization?
    1. Preventive
    2. Corrective
    3. Detective
    4. Deterrent
  283. Carla is reviewing the cybersecurity policies used by her organization. What policy might she put in place as a failsafe to cover employee behavior situations where no other policy directly applies?
    1. Data monitoring policy
    2. Account management policy
    3. Code of conduct
    4. Data ownership policy
  284. Which one of the following items is not normally included in a request for an exception to security policy?
    1. Description of a compensating control
    2. Description of the risks associated with the exception
    3. Proposed revision to the security policy
    4. Business justification for the exception
  285. What policy should contain provisions for removing user access upon termination?
    1. Data ownership policy
    2. Data classification policy
    3. Data retention policy
    4. Account management policy

    Questions 286–288 refer to the following scenario:

    Karen is the CISO of a major manufacturer of industrial parts. She is currently performing an assessment of the firm's financial controls, with an emphasis on implementing security practices that will reduce the likelihood of theft from the firm.

  286. Karen would like to ensure that the same individual is not able to both create a new vendor in the system and authorize a payment to that vendor. She is concerned that an individual who could perform both of these actions would be able to send payments to false vendors. What type of control should Karen implement?
    1. Mandatory vacations
    2. Separation of duties
    3. Job rotation
    4. Two-person control
  287. The accounting department has a policy that requires the signatures of two individuals on checks valued over $5,000. What type of control do they have in place?
    1. Mandatory vacations
    2. Separation of duties
    3. Job rotation
    4. Two-person control
  288. Karen would also like to implement controls that would help detect potential malfeasance by existing employees. Which one of the following controls is least likely to detect malfeasance?
    1. Mandatory vacations
    2. Background investigations
    3. Job rotation
    4. Privilege use reviews
  289. Kevin is conducting a security exercise for his organization that uses both offensive and defensive operations. His role is to serve as the moderator of the exercise and to arbitrate disputes. What role is Kevin playing?
    1. White team
    2. Red team
    3. Swiss team
    4. Blue team
  290. Bohai is concerned about access to the main account for a cloud service that his company uses to manage payment transactions. He decides to implement a new process for multifactor authentication to that account where an individual on the IT team has the password to the account, while an individual in the accounting group has the token. What security principle is Bohai using?
    1. Dual control
    2. Separation of duties
    3. Least privilege
    4. Security through obscurity
  291. Tina is preparing for a penetration test and is working with a new vendor. She wants to make sure that the vendor understands exactly what technical activities are permitted within the scope of the test. Where should she document these requirements?
    1. MOA
    2. Contract
    3. RoE
    4. SLA
  292. Azra is reviewing a draft of the Domer Doodads information security policy and finds that it contains the following statements. Which one of these statements would be more appropriately placed in a different document?
    1. Domer Doodads designates the chief information security officer as the individual with primary responsibility for information security.
    2. The chief information security officer is granted the authority to create specific requirements that implement this policy.
    3. All access to financial systems must use multifactor authentication for remote connections.
    4. Domer Doodads considers cybersecurity and compliance to be of critical importance to the business.
  293. Which one of the following security policy framework documents never includes mandatory employee compliance?
    1. Policy
    2. Guideline
    3. Procedure
    4. Standard
  294. Kaitlyn is on the red team during a security exercise, and she has a question about whether an activity is acceptable under the exercise's rules of engagement. Who would be the most appropriate person to answer her question?
    1. Red team leader.
    2. White team leader.
    3. Blue team leader.
    4. Kaitlyn should act without external advice.

    Questions 295–299 refer to the following scenario.

    Seamus is conducting a business impact assessment for his organization. He is attempting to determine the risk associated with a denial-of-service attack against his organization's datacenter.

    Seamus consulted with various subject-matter experts (SMEs) and determined that the attack would not cause any permanent damage to equipment, applications, or data. The primary damage would come in the form of lost revenue. Seamus believes that the organization would lose $75,000 in revenue during a successful attack.

    Seamus also consulted with his threat management vendor, who considered the probability of a successful attack against his organization and determined that there is a 10 percent chance of a successful attack in the next 12 months.

  295. What is the ARO for this assessment?
    1. 8 percent
    2. 10 percent
    3. 12 percent
    4. 100 percent
  296. What is the SLE for this scenario?
    1. $625
    2. $6,250
    3. $7,500
    4. $75,000
  297. What is the ALE for this scenario?
    1. $625
    2. $6,250
    3. $7,500
    4. $75,000
  298. Seamus is considering purchasing a DDoS protection system that would reduce the likelihood of a successful attack. What type of control is he considering?
    1. Detective
    2. Corrective
    3. Preventive
    4. Deterrent
  299. Seamus wants to make sure that he can accurately describe the category of the DDoS protection service to auditors. Which term best describes the category of this control?
    1. Compensating
    2. Physical
    3. Operational
    4. Technical

    Questions 300 and 301 refer to the following scenario:

    Piper's organization handles credit card information and is, therefore, subject to the Payment Card Industry Data Security Standard (PCI DSS). She is working to implement the PCI DSS requirements.

  300. As Piper attempts to implement PCI DSS requirements, she discovers that she is unable to meet one of the requirements because of a technical limitation in her point-of-sale system. She decides to work with regulators to implement a second layer of logical isolation to protect this system from the Internet to allow its continued operation despite not meeting one of the requirements. What term best describes the type of control Piper has implemented?
    1. Physical control
    2. Operational control
    3. Compensating control
    4. Deterrent control
  301. When Piper implements this new isolation technology, what type of risk management action is she taking?
    1. Risk acceptance
    2. Risk avoidance
    3. Risk transference
    4. Risk mitigation
  302. Ruth is helping a business leader determine the appropriate individuals to consult about sharing information with a third-party organization. Which one of the following policies would likely contain the most relevant guidance for her?
    1. Data retention policy
    2. Information security policy
    3. Data validation policy
    4. Data ownership policy
  303. Samantha is investigating a cybersecurity incident where an internal user used his computer to participate in a denial-of-service attack against a third party. What type of policy was most likely violated?
    1. AUP
    2. SLA
    3. BCP
    4. Information classification policy
  304. Ryan is compiling a list of allowable encryption algorithms for use in his organization. What type of document would be most appropriate for this list?
    1. Policy
    2. Standard
    3. Guideline
    4. Procedure
  305. During the design of an identity and access management authorization scheme, Katie took steps to ensure that members of the security team who can approve database access requests do not have access to the database themselves. What security principle is Katie most directly enforcing?
    1. Least privilege
    2. Separation of duties
    3. Dual control
    4. Security through obscurity
  306. Which one of the following controls is useful to both facilitate the continuity of operations and serve as a deterrent to fraud?
    1. Succession planning
    2. Dual control
    3. Cross-training
    4. Separation of duties
  307. Which one of the following requirements is often imposed by organizations as a way to achieve their original control objective when they approve an exception to a security policy?
    1. Documentation of scope
    2. Limited duration
    3. Compensating control
    4. Business justification
  308. Berta is reviewing the security procedures surrounding the use of a cloud-based online payment service by her company. She set the access permissions for this service so that the same person cannot add funds to the account and transfer funds out of the account. What security principle is most closely related to Berta's action?
    1. Least privilege
    2. Security through obscurity
    3. Separation of duties
    4. Dual control
  309. Thomas found himself in the middle of a dispute between two different units in his business that are arguing over whether one unit may analyze data collected by the other. What type of policy would most likely contain guidance on this issue?
    1. Data ownership policy
    2. Data classification policy
    3. Data retention policy
    4. Account management policy
  310. Mara is designing a new data mining system that will analyze access control logs for signs of unusual login attempts. Any suspicious logins will be automatically locked out of the system. What type of control is Mara designing?
    1. Physical control
    2. Operational control
    3. Managerial control
    4. Technical control
  311. Which one of the following elements is least likely to be found in a data retention policy?
    1. Minimum retention period for data
    2. Maximum retention period for data
    3. Description of information to retain
    4. Classification of information elements
  312. Kevin leads the IT team at a small business and does not have a dedicated security team. He would like to develop a security baseline of his organization's system configurations but does not have a team of security experts available to assist him. Which of the following is the most appropriate tool for Kevin to use?
    1. Penetration testing tool
    2. Patch management tool
    3. Vulnerability scanning tool
    4. Network monitoring tool
  313. Jenna is helping her organization choose a set of security standards that will be used to secure a variety of operating systems. She is looking for industry guidance on the appropriate settings to use for Windows and Linux systems. Which one of the following tools will serve as the best resource?
    1. ISO 27001
    2. OWASP
    3. PCI DSS
    4. CIS benchmarks
  314. Linda is attempting to configure Angry IP Scanner on her Linux scanning workstation and is receiving errors about missing required software. What component must be installed prior to using Angry IP Scanner?
    1. nmap
    2. Java
    3. gcc
    4. Nessus
  315. Chris is investigating a malware outbreak and would like to reverse engineer the code. Which one of the following tools is specifically designed for this task?
    1. Immunity debugger
    2. ZAP
    3. Recon-ng
    4. GDB
  316. Jim is working with a penetration testing contractor who proposes using Metasploit as part of his penetration testing effort. What should Jim expect to occur when Metasploit is used?
    1. Systems will be scanned for vulnerabilities.
    2. Systems will have known vulnerabilities exploited.
    3. Services will be probed for buffer overflow and other unknown flaws.
    4. Systems will be tested for zero-day exploits.
  317. Which one of the following best describes recon-ng as a security tool?
    1. Vulnerability scanner
    2. Web application reconnaissance tool
    3. Network mapper
    4. Password cracker
  318. Ashley is investigating an attack that compromised an account of one of her users. In the attack, the attacker forced the submission of an authenticated request to a third-party site by exploiting trust relationships in the user's browser. What type of attack most likely took place?
    1. XSS
    2. CSRF
    3. SQL injection
    4. Session hijacking
  319. Juanita is a cybersecurity professional who works with data scientists at a company that uses machine learning (ML) models to predict customer behavior. She believes that their work has been the target of a data poisoning attack.

    Which of the following actions should she take to address the situation?

    1. Ignore the problem as it is unlikely to have an operational effect.
    2. Remove affected data from the training dataset and generate a new model.
    3. Generate a new model using the same dataset and machine learning algorithm.
    4. Generate a new model using the same dataset and a different machine learning algorithm.
  320. Joshua is concerned about insecure software design practices and is developing a software threat modeling program for his organization. Which of the following is not an appropriate goal for this program?
    1. To reduce the number of security-related design flaws
    2. To reduce the number of security-related coding flaws
    3. To reduce the severity of non-security-related flaws
    4. To reduce the number of threat vectors
  321. Gavin works as a cybersecurity analyst and notices that issues continually arise in his organization where system administrators modify system configuration files without providing advance notice to other teams. In several situations, this resulted in a security misconfiguration. What control would best prevent these issues from recurring in the future?
    1. Change management program
    2. Security-enhanced operating system
    3. Configuration lockdown
    4. File integrity monitoring
  322. Brenda maintains a web application and learned that the application contains a remote code execution vulnerability that is triggered by sending a carefully crafted message to a logging service that runs on the underlying server. What action should Brenda take to best address this risk?
    1. Modify the code of the web application to eliminate the vulnerability.
    2. Install an intrusion detection system.
    3. Check for and apply patches from the logging vendor.
    4. Ignore the issue because the logging service is not her responsibility.
  323. Viola is analyzing an attack that occurred against her organization. The attacker was able to manipulate a web application to display a confidential data file that was stored on the server by traversing the directory structure in the URL. What term best describes this type of attack?
    1. SQL injection
    2. Server-side request forgery
    3. Local file inclusion
    4. Remote file inclusion
  324. Melissa is concerned that users in her organization are connecting to corporate systems over insecure networks and begins a security awareness campaign designed to encourage them to use the VPN. What category of control has Melissa implemented?
    1. Compensating
    2. Technical
    3. Operational
    4. Managerial
  325. The company Chris works for has notifications posted at each door reminding employees to be careful not to allow people to enter when they do. Which type of control is this?
    1. Detective
    2. Responsive
    3. Preventive
    4. Corrective
  326. Kevin has discovered a security vulnerability in one of his organization's business-critical systems. He evaluates the situation and determines that it presents a low risk to the organization but would like to correct it. There is a patch available from the vendor. When should Kevin plan to apply the patch?
    1. Immediately
    2. During the next scheduled maintenance window
    3. As soon as possible outside of normal business hours
    4. During the next major system upgrade
  327. Ben is responsible for the security of payment card information stored in a database. Policy directs that he remove the information from the database, but he cannot do this for operational reasons. He obtained an exception to policy and is seeking an appropriate compensating control to mitigate the risk. What would be his best option?
    1. Purchasing insurance
    2. Encrypting the database contents
    3. Removing the data
    4. Objecting to the exception
  328. Isabelle wants to prevent privilege escalation attacks via her organization's service accounts. Which of the following security practices is best suited to this?
    1. Remove unnecessary rights.
    2. Disable interactive login for service accounts.
    3. Limit when accounts can log in.
    4. Use meaningless or randomized names for service accounts.
  329. Brandon is validating the security of systems and devices in his organization, but he is permitted to use only passive techniques. Which one of the following actions would be considered passive discovery?
    1. Monitoring network traffic and analyzing the contents for signs of unpatched systems and applications
    2. Running vulnerability scans of an organization's servers
    3. Running port scans of an organization's servers
    4. Using carefully scoped penetration testing techniques to identify vulnerabilities
  330. Ryan's organization wants to ensure that proper account management is occurring but does not have a central identity and access management tool in place. Ryan has a limited amount of time to do his verification process. What is his best option to test the account management process as part of an internal audit?
    1. Validate all accounts changed in the past 90 days.
    2. Select high value administrative accounts for validation.
    3. Validate all accounts changed in the past 180 days.
    4. Validate a random sample of accounts.
  331. Which one of the following security testing programs is designed to attract the participation of external testers and incentivize them to uncover security flaws?
    1. Penetration test
    2. Internal vulnerability scan
    3. Bug bounty
    4. External vulnerability scan
  332. Frank's team is testing a new API that his company's developers have built for their application infrastructure. Which of the following is not a common API issue that you would expect Frank's team to find?
    1. Improper encryption
    2. Object level authorization issues
    3. User authentication issues
    4. Lack of rate limiting
  333. Ryan is considering the use of fuzz testing in his web application testing program. Which one of the following statements about fuzz testing is true?
    1. Fuzzers find only complex faults.
    2. Testers must manually generate input.
    3. Fuzzers may not fully cover the code.
    4. Fuzzers can't reproduce errors.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.147.61.142