CySa+ PT 4: 2/3

The presence of _________________ triggers specific vulnerability scanning requirements based upon law or regulation.

• ​Credit card information

• ​Protected health information

• Personally identifiable information

• Trade secret information

Jesus is creating a remediation procedure for vulnerabilities discovered in his organization. He would like to make sure that any vendor patches are tested prior to deploying them in production. What type of environment should be included to best address this issue?

• Sandbox

• Honeypot

• Honeynet

• Production

James is working on developing a vulnerability scanner program for a large network of sensors that his organization uses to monitor a transcontinental gas pipeline. What term is typically used to describe this type of network?

• ​WLAN

• VPN

• P2P

• ​SCADA

Timothy’s company is starting a BYOD (bring your own device) policy for all mobile devices. Which of the following allows you to secure the sensitive information on personally owned devices, including administrators, and the ability to remotely wipe corporate information without affecting personal data?

• ​Remote wipe

• Strong passwords

• ​Biometric authentication

• ​Containerization

Patrick is the manager of his organization's vulnerability scanning program. He’s experiencing some issues with scans aborting because the previous day scans are still running when the scanner attempts to start the current scans. Which of the following solutions is least likely to resolve the issue?

• Add a new scanner

• Reduce the scope of scans

• Reduce the sensitivity of scans

• Reduce the frequency of scans

Cherish is attempting to determine what systems should be subject to vulnerability scanning and what systems are exempt. She’d like to have a base for this decision relating to the criticality of system to business operations. Where would she find this information?

• ​The CEO

• System names

• ​IP addresses

• ​Asset inventory

TRUE or FALSE: Organizations may decide not to remediate vulnerabilities because of conflicting business requirements.

• TRUE

• FALSE

Which of the following vulnerabilities would you consider the greatest threat to information confidentiality?

• ​HTTP TRACE/TRACK methods enabled

• SSL Server with SSLv3 enabled vulnerability

• ​phpinfo information disclosure vulnerability

• ​Web application SQL injection vulnerability

Barrett noticed a critical vulnerability in a database at his organization. He received permission to implement an emergency change after the close of the business day. There are currently eight hours before the change window. What else needs to be done to prepare for the change?

• Ensure all stakeholders are informed of planned outage

• Document the change in the change management system

• Identify any potential risks associated with the change

• All supplied choices

What SCAP component provides a language for specifying checklists?

• ​XCCDF

• ​CPE

• CCE

• OVAL