Threat and Vulnerability Management – Part A

A penetration tester is analyzing the output from a web server’s access logs and notices that there is a high volume of requests for a specific URL that does not exist. What could this indicate?

A security analyst is investigating a series of cyber attacks targeting the company’s email servers. The analyst needs to gather intelligence about the attack tactics and the threat actors behind the attacks. Which open-source intelligence (OSINT) source can the analyst use to obtain this information?

A security analyst is investigating a cyber attack that took place on the company’s network over the weekend. The analyst needs to gather intelligence about the attack and the threat actors behind it. Which intelligence source should the analyst use to obtain timely information about the attack?

A security analyst is investigating a series of phishing attacks targeting the company’s employees. The analyst needs to gather intelligence about the tactics and the threat actors behind the attacks. Which intelligence source should the analyst use to obtain relevant information about the attacks?

A security analyst is investigating a series of attacks that appear to be targeting the company’s financial systems. The analyst needs to gather intelligence about the threat actors and their capabilities. Which intelligence source should the analyst use to obtain information with a high confidence level?

A security team is trying to share information about a new type of malware with other organizations in their industry. The team wants to use a standardized format to share the information. Which threat intelligence sharing format should the team use?

A security team is investigating a data breach that occurred on the company’s network. The team needs to gather intelligence about the malware that was used in the attack. Which threat intelligence source should the team use to obtain TAXII-formatted intelligence about the malware?

A security analyst is investigating a cyber attack on a company’s network. The analyst needs to gather intelligence about the indicators of compromise used in the attack. Which structured format for sharing information about indicators of compromise and malware behavior uses a simple XML schema and is compatible with other cybersecurity tools?

A security team is analyzing a new threat that has been discovered on the network. The team has identified that the threat is using a known exploit to gain access to the network. Which type of threat is this an example of?

A security team has identified a new vulnerability in a critical system that is being actively exploited by attackers. The vulnerability was previously unknown and there is no known patch or workaround. Which type of threat is this an example of?

A security team has discovered that an attacker has been infiltrating the network for several months, conducting reconnaissance, and exfiltrating sensitive data. Which type of threat is this an example of?

A government agency has identified a sophisticated cyber attack that is targeting a specific department. The attackers have used custom malware and techniques that are consistent with previous attacks attributed to a particular country. Which type of threat actor is this an example of?

A group of attackers has compromised the email accounts of several prominent politicians and released sensitive information to the public. The attackers claim to be motivated by a desire to expose corruption and promote transparency in government. Which type of threat actor is this an example of?

A healthcare organization is considering joining an information-sharing and analysis community (ISAC) for the healthcare industry. Which of the following is a potential benefit of participating in an ISAC?

A small financial services firm is considering joining an information-sharing and analysis organization (ISAO) for the first time. The CEO is hesitant because of concerns about sharing sensitive information with other organizations. Which of the following is a key benefit of ISAO membership that could address these concerns?

A government agency is looking to improve its threat intelligence capabilities. Which of the following would be the best way to leverage an information-sharing and analysis community (ISAC)?

In a recent security incident, your organization detected a suspicious process running on several endpoints. To determine if this is an actual threat, you decide to use MITRE ATT&CK to research potential attack techniques. Which MITRE ATT&CK tactic should you focus on to gain insight into how the threat actor might have gained a foothold in your environment?

A security analyst has identified an intrusion in the organization’s network. The analyst wants to understand the attacker’s tactics, techniques, and procedures (TTPs) to improve their defense strategy. Which attack framework should the analyst use to analyze the intrusion and identify the TTPs?

A security analyst has received an alert that a user account has been compromised and the attacker is attempting to escalate privileges on the network. What stage of the Kill chain is this activity associated with?

A company has recently been receiving phishing emails that are spoofing its own domain. The security team wants to conduct a reputational threat research to determine if their domain has been listed on any blacklist due to previous malicious activities. Which of the following tools or techniques can the security team use for this purpose?

A cybersecurity analyst has detected unusual behavior on a company’s network. They suspect a malware infection but are not able to identify the type of malware. Which type of threat research would be MOST useful in this scenario?

An organization is trying to prevent a ransomware attack and has identified certain indicators of compromise (IoCs) that are associated with known ransomware families. Which of the following would be most effective in utilizing these IoCs to protect against the threat?

A security team has received an alert that a new vulnerability has been discovered in a commonly used software application. The team is responsible for prioritizing the patching of vulnerabilities based on the risk they pose to the organization. Which CVSS metric would be most relevant in this scenario?

A company has identified its critical assets and potential attack vectors. What additional steps should the company take to improve its threat modeling and prepare for potential attacks?

In a threat modeling exercise, which of the following best describes the ‘total attack surface’?

In a threat modeling exercise, a security analyst is asked to identify the total attack surface of a new web application. Which of the following would be the most important factor to consider?

In threat modeling, what does the term “attack vector” refer to?

Which of the following is an example of threat intelligence that can be used in incident response?

A company has implemented a vulnerability management program and is using threat intelligence to identify potential threats. Which of the following is an example of utilizing threat intelligence to support vulnerability management?

In a large organization, the security operations center (SOC) team is responsible for monitoring the network and detecting potential threats. A security analyst has identified a suspicious IP address that is attempting to connect to a database server. The analyst uses threat intelligence to further investigate this IP address and discovers that it has been linked to several successful attacks against financial institutions in the past. What is the next step the analyst SHOULD take to support the detection and monitoring function?

Which of the following is a disadvantage of active scanning for vulnerability identification?

In which of the following scenarios is passive scanning preferred over active scanning for vulnerability identification?

A security analyst is tasked with identifying vulnerabilities in a company’s network infrastructure. Which of the following activities involves mapping/enumeration to discover vulnerable systems?

You are conducting a vulnerability scan of your organization’s network and come across a potential vulnerability in a web application that could lead to unauthorized access. You decide to investigate the issue further and perform a manual penetration test, which confirms the presence of the vulnerability. What type of result is this considered?

A vulnerability scanning tool has identified a potential vulnerability in a server that hosts a critical application. The IT team responsible for managing the server has conducted a thorough investigation and determined that the identified vulnerability does not exist on the server. Which of the following best describes this situation?

In the context of vulnerability management, which of the following is an example of a true negative?

A security analyst is conducting a vulnerability scan on a system and the scan tool reported no vulnerabilities. However, the analyst later discovered that the system was actually vulnerable to an exploit that was used by an attacker to gain unauthorized access. Which of the following statements correctly describes the type of validation error in this scenario?

A system administrator has been tasked with implementing a new security standard to ensure all systems are configured securely. What should be the first step in this process?

An organization’s vulnerability scanning identified a critical vulnerability on a server that could allow an attacker to execute remote code. The IT team has determined that the server is running an outdated version of the operating system, which is the root cause of the vulnerability. What is the most effective remediation strategy?

A network administrator discovered a vulnerability on a server that is running a critical application. The vulnerability is due to a configuration error that allows unauthenticated access to the application’s administrative console. What is the most effective remediation strategy?

What is the best approach to reduce the risk associated with scanning activities?

An organization wants to perform a vulnerability scan on its network to identify and remediate any issues. However, they are concerned about the security risks of providing credentials to the scanning tool. Which of the following best describes the difference between credentialed and non-credentialed scans?

In a large enterprise environment with numerous servers and endpoints, the IT team is responsible for regularly scanning and patching vulnerabilities. Which remediation method is best suited for this scenario?

A security analyst is tasked with remediating a vulnerability that was identified during a vulnerability scan. The vulnerability is located on a web server that hosts a critical business application. The remediation plan requires changes to the server’s configuration. Which remediation method is BEST suited for this scenario?

A company has a database containing sensitive customer information, including social security numbers, credit card numbers, and home addresses. The company’s vulnerability scanner regularly scans the database, but the security team recently discovered that the scanner is not detecting vulnerabilities in the credit card number fields. What type of scanning parameter should the team adjust to ensure that these vulnerabilities are identified?

Which of the following is an advantage of true negative results in vulnerability management?

In a large organization, the vulnerability scanning team has been requested to perform a full network scan. The team has limited time to perform the scan due to tight deadlines. Which of the following scanning parameters would be most appropriate to use in this scenario?

In a large enterprise environment, the vulnerability management team is performing a vulnerability scan on the company’s network. However, the intrusion prevention system (IPS) keeps blocking the scanning traffic and does not allow the vulnerability scanner to complete the scan. What is the BEST way to ensure successful completion of the vulnerability scan?

A security analyst is conducting a vulnerability scan on a network protected by an intrusion detection system (IDS) and a firewall. During the scan, the IDS alerts on some of the scan traffic, but the firewall does not. What is the likely reason for this difference in behavior?

In a large organization, a security analyst has discovered a critical vulnerability in a third-party software component used by the marketing department. However, the marketing department is reluctant to apply a patch to the software as it might cause instability in their applications. What could be a potential inhibitor to remediation in this scenario?

A mobile application allows users to upload and share photos. An attacker can use this functionality to upload malicious images that contain hidden malware. What is the BEST control to mitigate this vulnerability?

Which of the following is an effective control for mitigating a dereferencing vulnerability?

A web application allows users to make purchases online. Each user has a unique account number associated with their profile, which they can access to view their purchase history. A hacker discovers that by changing the account number in the URL, they can view other users’ purchase history. What control should be implemented to mitigate this insecure object reference vulnerability?

A company’s web application uses a shared resource to manage customer transactions. The application does not implement any locking mechanism, which causes race conditions. What is the best control to mitigate this vulnerability?

A company has recently experienced several security incidents where attackers gained unauthorized access to sensitive data by exploiting vulnerabilities in their authentication system. The company wants to implement controls to mitigate these attacks. Which of the following controls would be MOST effective in preventing broken authentication vulnerabilities?

A software developer is creating a web application that will be used by multiple departments within a company. The developer includes a third-party component to add functionality to the application. However, the security team discovers that the third-party component has a vulnerability that could allow attackers to bypass authentication and gain unauthorized access to sensitive data. What control can the security team implement to mitigate this vulnerability?

A company has recently identified that its IT environment is vulnerable to the risk of insecure components due to the use of outdated and unsupported software. They want to implement controls to mitigate this risk. Which of the following measures should they take?

A company recently purchased a new web application that is designed to run on a Linux server. The server was set up using default configurations, and the company’s IT team has noticed some security concerns. Which of the following actions could help mitigate the vulnerabilities associated with weak or default configurations?

A software developer has written a new function for a web application using the strcpy function to copy data from one string to another. The developer is unaware of the security risks associated with the use of the strcpy function. Which control would be the most effective in mitigating the vulnerability of the application to attacks leveraging the use of insecure functions such as strcpy?

A developer is coding a new application that requires a large amount of memory to store user input data. During testing, it is found that an attacker can overflow the heap and execute arbitrary code. Which of the following is the most effective control to mitigate this attack?