Chapter 6: Designing a Vulnerability Management Program

What federal law requires the use of vulnerability scanning on information systems operated by federal government agencies?

• 1. HIPAA

• 1. GLBA

• 1. FISMA

• 1. FERPA

Answer explanation

The Federal Information Security Management Act (FISMA) requires that federal agencies implement vulnerability management programs for federal information systems. The Health Insurance Portability and Accountability Act (HIPAA) regulates the ways that healthcare providers, insurance companies, and their business associates handle protected health (PHI) information. Similarly, the Gramm–Leach–Bliley Act (GLBA) governs how financial institutions handle customer financial records. The Family Educational Rights and Privacy Act (FERPA), which is not covered in this chapter or on the CySA+ exam, allows parents to access their children's educational records.

Which one of the following industry standards describes a standard approach for setting up an information security management system?

• 1. OWASP

• 1. CIS

• 1. ISO 27002

• 1. ISO 27001

Answer explanation

ISO 27001 describes a standard approach for setting up an information security management system, while ISO 27002 goes into more detail on the specifics of information security controls. The Open Web Application Security Project (OWASP) provides advice and tools focused on web application security. The Center for Internet Security (CIS) produces a set of configuration benchmarks used to securely configure operating systems, applications, and devices.

What tool can administrators use to help identify the systems present on a network prior to conducting vulnerability scans?

• 1. Asset inventory

• 1. Web application assessment

• 1. Router

• 1. DLP

Answer explanation

An asset inventory supplements automated tools with other information to detect systems present on a network. The asset inventory provides critical information for vulnerability scans.

Tonya is configuring vulnerability scans for a system that is subject to the PCI DSS compliance standard. What is the minimum frequency with which she must conduct scans?

• 1. Daily

• 1. Weekly

• 1. Monthly

• 1. Quarterly

Answer explanation

1. D. PCI DSS requires that organizations conduct vulnerability scans on at least a quarterly basis, although many organizations choose to conduct scans on a much more frequent basis.

Which one of the following is not an example of a vulnerability scanning tool?

• 1. Nikto

• 1. Snort

• 1. Nessus

• 1. OpenVAS

Answer explanation

Nessus and OpenVAS are network vulnerability scanning tools, while Nikto is a web application vulnerability scanner. Snort is an intrusion detection system.

Bethany is the vulnerability management specialist for a large retail organization. She completed her last PCI DSS compliance scan in March. In April, the organization upgraded their point-of-sale system, and Bethany is preparing to conduct new scans. When must she complete the new scan?

• 1. Immediately.

• 1. June.

• 1. December.

• 1. No scans are required.

Answer explanation

PCI DSS requires that organizations conduct vulnerability scans quarterly, which would have Bethany's next regularly scheduled scan scheduled for June. However, the standard also requires scanning after any significant change in the payment card environment. This would include an upgrade to the point-of-sale system, so Bethany must complete a new compliance scan immediately.

Renee is configuring her vulnerability management solution to perform credentialed scans of servers on her network. What type of account should she provide to the scanner?

• 1. Domain administrator

• 1. Local administrator

• 1. Root

• 1. Read-only

Answer explanation

Credentialed scans only require read-only access to target servers. Renee should follow the principle of least privilege and limit the access available to the scanner.

Jason is writing a report about a potential security vulnerability in a software product and wishes to use standardized product names to ensure that other security analysts understand the report. Which SCAP component can Jason turn to for assistance?

• 1. CVSS

• 1. CVE

• 1. CPE

• 1. OVAL

Answer explanation

Common Platform Enumeration (CPE) is an SCAP component that provides standardized nomenclature for product names and versions.

Bill would like to run an internal vulnerability scan on a system for PCI DSS compliance purposes. Who is authorized to complete one of these scans?

• 1. Any employee of the organization

• 1. An approved scanning vendor

• 1. A PCI DSS service provider

• 1. Any qualified individual

Answer explanation

Internal scans completed for PCI DSS compliance purposes may be conducted by any qualified individual.

Which type of organization is the most likely to face a regulatory requirement to conduct vulnerability scans?

• 1. Bank

• 1. Hospital

• 1. Government agency

• 1. Doctor's office

Answer explanation

The Federal Information Security Management Act (FISMA) requires that government agencies conduct vulnerability scans. HIPAA, which governs hospitals and doctors' offices, does not include a vulnerability scanning requirement, nor does GLBA, which covers financial institutions. Banks may be required to conduct scans under PCI DSS, but this is a contractual obligation and not a statutory requirement.