A server within your organization has suffered six hardware failures in the past year. IT management personnel have valued the server at $4,000, and each failure resulted in a 10 percent loss. What is the ALE?

• $400

• $2400

• $4000

• $6000

Answer explanation

B is correct. The annual loss expectancy (ALE) is $2,400. It is calculated as single loss expectancy (SLE) × annual rate of occurrence (ARO). Each failure has resulted in a 10 percent loss (meaning that it cost 10 percent of the asset value to repair it). The SLE is 10 percent of $4,000 ($400), and the ARO is 6. 6 × $400 is $2400.

Maggie is performing a risk assessment on a database server. While doing so, she created a document showing all the known risks to this server, along with the risk score for each risk. Which of the following BEST identifies the name of this document?

• Qualitative risk assessment

• Quantitative risk assessment

• Risk register

• Residual risk

Answer explanation

C is correct. A risk register lists all known risks for an asset, such as a database server, and it typically includes a risk score (the combination of the likelihood of occurrence and the impact of the risk). Risk assessments (including qualitative and quantitative risk assessments) might use a risk register, but they are not risk registers. Residual risk refers to the remaining risk after applying security controls to mitigate a risk.

Your organization hosts an e-commerce website used to sell digital products. You are tasked with evaluating all the elements used to support this website. What are you performing?

• Quantitative assessment

• Qualitative assessment

• Threat hunting

• Supply chain assessment

Answer explanation

D is correct. A supply chain assessment evaluates all the elements used to create, sell, and distribute a product. The National Institute of Standards and

Technology (NIST) Risk Management Framework (RMF) (NIST SP 800-

37 r2) provides steps for reducing supply chain risks. Risk assessments (including both quantitative and qualitative risk assessments) evaluate risks, but don’t evaluate the supply chain required to support an e-commerce website. Threat hunting is the process of actively looking for threats within a network before an automated tool detects and reports on the threat.

Which of the following elements are used as part of threat hunting?

(Choose two.)

• Intelligence fusion

• Vulnerability scan

• Advisories and bulletins

• Configuration review

Answer explanation

A and C are correct. Intelligence fusion and advisories and bulletins are part of threat hunting. Threat hunting is the process of actively looking for threats within a network before an automated tool detects and reports on the threat. Vulnerability scans are used as part of a security assessment. Although a history of vulnerability scans and related logs may be part of the intelligence fusion, CompTIA objectives specifically list the following four elements: intelligence fusion, advisories and bulletins, threat feeds, and predictions of how attackers may maneuver though the network. A configuration review verifies that systems are configured correctly.

Maggie suspects that a server may be running unnecessary services. Which of the following tools is the BEST choice to identify the services running on the server?

• Dnsenum

• IP scanner

• Passive reconnaissance

• Nmap

Answer explanation

D is correct. Nmap is a network scanner, and it can detect the protocols and services running on a server. The dnsenum command will enumerate (or list) Domain Name System (DNS) records for domains. An IP scanner detects IPs active on a network but not the services running on the individual hosts. Passive reconnaissance uses open source intelligence (OSINT) instead of active tools.

You want to identify all the services running on a server in your network.

Which of the following tools is the BEST choice to meet this goal?

• Penetration test

• Protocol analyzer

• Non-credentialed scan

• Port scanner

Answer explanation

D is correct. A port scanner identifies open ports on a system and is commonly used to determine what services are running on the system. Vulnerability scanners often include port-scanning capabilities, and they can help identify potential weak configurations. A penetration test attempts to exploit a vulnerability. A protocol analyzer can analyze traffic and discover protocols in use, but this would be much more difficult than using a port scanner. A non-credentialed scan refers to a vulnerability scan, and while a vulnerability scan may reveal services running on a server, it won’t be as specific as a port scan.

You recently completed a vulnerability scan on a database server. The scan didn’t report any issues. However, you know that it is missing a patch. The patch wasn’t applied because it causes problems with the database application. Which of the following BEST describes this?

• False negative

• False positive

• Credential scan

• Non-credentialed scan

Answer explanation

A is correct. A false negative occurs if a vulnerability scanner does not report a known vulnerability. A false positive occurs when a vulnerability scanner reports a vulnerability that doesn’t exist. The scenario doesn’t indicate if the scan was run under the context of an account (credentialed) or anonymously (non-credentialed), so these answers aren’t relevant to the question.

You suspect that a database server used by a web application is not up to date with current patches. Which of the following is the BEST action to take to verify the server has up-to-date patches?

• Network scan

• Port scan

• Protocol analyzer

• Vulnerability scan

Answer explanation

D is correct. A vulnerability scan determines if the system has current patches. None of the other answers will detect missing patches. A network scan will discover devices on the network. It might look for and detect vulnerabilities on network devices, but it would not be used to scan a single server for patches. A port scan identifies open ports. A protocol analyzer (sniffer) captures traffic for analysis.

Lisa periodically runs vulnerability scans on the organization’s network. Lately, she has been receiving many false positives. Which of the following actions can help reduce the false positives?

• Run the scans as credentialed scans.

• Run the scans as non-credentialed scans.

• Run the scans using passive reconnaissance.

• Run the scans using active reconnaissance.

Answer explanation

A is correct. Running the scans as credentialed scans (within the context of a valid account) allows the scan to see more information and typically results in fewer false positives. A false positive indicates the scan reported a vulnerability that doesn’t exist. Non-credentialed scans run without any user credentials and can be less accurate. Choosing either passive or active scans won’t reduce false positives.

Your organization has hired outside penetration testers to identify internal network vulnerabilities. After successfully exploiting vulnerabilities in a single computer, the testers attempt to access other systems within the network. Which of the following BEST describes their current actions?

• Partially known environment testing

• Persistence

• Lateral movement

• Privilege escalation

Answer explanation

C is correct. Lateral movement refers to actions taken to move through a network after successfully exploiting a single system. While not available as a possible answer, this could also be described as pivoting, which is the process of accessing other systems through a single compromised system. Partially known environment testing (sometimes called gray box testing) indicates the testers have some knowledge of a system or network before starting, but there is no indication in the scenario about their level of knowledge. Persistence refers to maintaining a presence on the system or network after the initial exploit. Privilege escalation refers to gaining higher privileges after an initial exploit.