SYO 701 VULNERABILITY MANAGEMENT Module FC

245. Which of the following methods would most likely be used to identify legacy systems?

• A. Bug bounty program

• B. Vulnerability scan

• C. Package monitoring

• D. Dynamic analysis

41. Which of the following is used to quantitatively measure the criticality of a vulnerability?

• A. CVE

• B. CVSS

• C. CIA

• D. CERT

313. Which of the following is best to use when determining the severity of a vulnerability?

• A. CVE

• B. OSINT

• C. SOAR

• D. CVSS

295. An auditor discovered multiple insecure ports on some servers. Other servers were found to have legacy protocols enabled. Which of the following tools did the auditor use to discover these issues?

• A. Nessus

• B. curl

• C. Wireshark

• D. netcat

627. A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most difficult to remediate due to the company’s reliance on open-source libraries?

• A. Buffer overflow

• B. SQL injection

• C. Cross-site scripting

• D. Zero-day

50. A security practitioner completes a vulnerability assessment on a company's network and finds several vulnerabilities, which the operations team remediates. Which of the following should be done next?

• A. Conduct an audit.

• B. Initiate a penetration test.

• C. Rescan the network.

• D. Submit a report.

316. A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:

 

 

 

Which of the following attack techniques was most likely used?

• A. Determining the organization's ISP-assigned address space

• B. Bypassing the organization's DNS sinkholing

• C. Footprinting the internal network

• D. Attempting to achieve initial access to the DNS server

• E. Exfiltrating data from fshare.int.complia.org

437. Which of the following is a risk of conducting a vulnerability assessment?

• A. A disruption of business operations

• B. Unauthorized access to the system

• C. Reports of false positives Most Voted

• D. Finding security gaps in the system

309. 309. A third-party vendor is moving a particular application to the end-of-life stage at the end of the current year. Which of the following is the most critical risk if the company chooses to continue running the application?

• A. Lack of security updates

• B. Lack of new features

• C. Lack of support

• D. Lack of source code access

226. A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system. Which of the following techniques would increase enterprise security?

• A. Installing HIDS on the system

• B. Placing the system in an isolated VLAN

• C. Decommissioning the system

• D. Encrypting the system's hard drive