Practice Tests - Chapter 2: Domain 2.0: Vulnerability Management

Question 1

1- During the reconnaissance stage of a penetration test, Cynthia needs to gather information about the target organization’s network infrastructure without causing an IPS to alert the target to her information gathering. Which of the following is her best option?

• Perform a DNS brute‐force attack.
• Use an Nmap ping sweep.
• Perform a DNS zone transfer.
• Use an Nmap stealth scan.

Answer 1

Perform a DNS brute‐force attack.

Although it may seem strange, a DNS brute‐force attack that queries a list of IP addresses, common subdomains, or other lists of targets will often bypass intrusion detection and prevention systems that do not pay particular attention to DNS queries. Cynthia may even be able to find a DNS server that is not protected by the organization’s IPS! Nmap scans are commonly used during reconnaissance, and Cynthia can expect them to be detected since they are harder to conceal. Cynthia shouldn’t expect to be able to perform a DNS zone transfer, and if she can, a well‐configured IPS should immediately flag the event.

Question 2

database vendor default ports

Answer 2

• MySQL: 3306
• Oracle: 1521
• Postgres: 5423
• MS SQL: 1433/1434

Question 3

3- During a port scan of her network, Cynthia discovers a workstation that shows the following ports open. What should her next action be?

Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-26 19:25 EDT
Nmap scan report for deptsrv (192.168.2.22)
Host is up (0.0058s latency).
Not shown: 65524 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
7680/tcp open unknown
49677/tcp open unknown
MAC Address: AD:5F:7B:48:7D (Intel Corporation)

Nmap done: 1 IP address (1 host up) scanned in 121.29 seconds

• Determine the reason for the ports being open.
• Investigate the potentially compromised workstation.
• Run a vulnerability scan to identify vulnerable services.
• Reenable the workstation’s local host firewall

Answer 3

Determine the reason for the ports being open.

Cynthia’s first action should be to determine whether there is a legitimate reason for the workstation to have the listed ports open.

Question 4

4- Which one of the following threats is the most pervasive in modern computing environments?

• Zero‐day attacks
• Advanced persistent threats
• Malware
• Insider threats

Answer 4

Malware

All of the threats described here are serious threats that exist in modern enterprises. However, the most pervasive threat is standard malware, which threatens essentially every computing environment on an almost constant basis.

Question 5

6- What is the default Nmap scan type when Nmap is not provided with a scan type flag?

• A TCP FIN scan
• A TCP connect scan
• A TCP SYN scan
• A UDP scan

Answer 5

A TCP SYN scan

By default, Nmap uses a TCP SYN scan. If the user does not have proper socket privileges (such as root on a Linux system), it will use a TCP connect scan.

Question 6

7- Lakshman wants to limit what potential attackers can gather during passive or semipassive reconnaissance activities. Which of the following actions will typically most reduce his organization’s footprint?

• Limit information available via the organizational website without authentication.
• Use a secure domain registration.
• Limit technology references in job postings.
• Purge all document metadata before posting.

Answer 6

Limit information available via the organizational website without authentication.

Limiting the information available about an organization by requiring authentication will strongly limit the ability of potential attackers to gather information. Secure domain registration may conceal the registration contact’s information but does not provide any real additional protection. Limiting technologies listed in a job posting can help limit what attackers may find out, but most organizations would prefer to better match candidates. Finally, purging all metadata can help protect information about internal systems and devices but is difficult to enforce, and document metadata is not a primary source of information about most organizations.

Question 7

8- Cassandra’s Nmap scan of an open wireless network (192.168.10/24) shows the following host at IP address 192.168.1.1. Which of the following is most likely to be the type of system at that IP address based on the scan results shown?

PORT STATE SERVICE VERSION
22/tcp open ssh Dropbear sshd 2016.74 (protocol 2.0)
53/tcp open domain dnsmasq 2.76
80/tcp open http Acme milli_httpd 2.0 (ASUS RT-AC-series router)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
515/tcp open tcpwrapped
1723/tcp open pptp Linux (Firmware: 1)
8200/tcp open upnp MiniDLNA 1.1.5 (OS: 378.xx; DLNADOC 1.50; UPnP 1.0)
8443/tcp open ssl/http Acme milli_httpd 2.0 (ASUS RT-AC-series router)
9100/tcp open jetdirect?
9998/tcp open tcpwrapped
Device type: bridge|general purpose

• A virtual machine
• A wireless router
• A broadband router
• A print server

Answer 7

A wireless router

Since Cassandra is scanning a wireless network and the system is using an IP address that is commonly used for commodity wireless routers, her best guess should be that this is a wireless router that can be accessed via SSH and that is providing a web management interface and print services. The OS fingerprinting that Nmap provides is not always reliable, and the VirtualBox match is a false positive in this case. The actual host scanned is an Asus router running open source firmware and additional software.

Question 8

9- Several organizations recently experienced security incidents when their AWS secret keys were published in public GitHub repositories. What is the most significant threat that could arise from this improper key management?

• Total loss of confidentiality
• Total loss of integrity
• Total loss of availability
• Total loss of confidentiality, integrity, and availability

Answer 8

Total loss of confidentiality, integrity, and availability

Depending on the level of access associated with the key, this error could give anyone discovering the key total control of an organization’s AWS account, resulting in a complete loss of confidentiality, integrity, and availability.

Question 9

11- Andrea wants to conduct a passive footprinting exercise against a target company. Which of the following techniques is not suited to a passive footprinting process?

• WHOIS lookups
• Banner grabbing
• BGP looking glass usage
• Registrar checks

Answer 9

Banner grabbing

Banner grabbing is an active process and requires a connection to a remote host to grab the banner. The other methods are all passive and use third‐party information that does not require a direct lookup against a remote host.

Question 10

BGP looking glass

Answer 10

A BGP (Border Gateway Protocol) looking glass is a public server that allows you to view an organization’s external network connectivity setup

Question 11

12- Alex wants to scan a protected network and has gained access to a system that can communicate to both his scanning system and the internal network. What type of Nmap scan should Alex conduct to leverage this host if he cannot install Nmap on system A?

• A reflection scan
• A proxy scan
• A randomized host scan
• A ping‐through scan

Answer 11

A proxy scan

Nmap supports the use of both HTTP and SOCKS4 proxies, allowing Alex to configure the remote host as an HTTP proxy and bounce his scans through it. This can allow Nmap users to leverage their scanning tools without installing them on a protected host or network.

Question 12

14- Alex has been asked to assess the likelihood of reconnaissance activities against her organization (a small, regional business). Her first assignment is to determine the likelihood of port scans against systems in her organization’s screened subnet (otherwise known as a DMZ). How should she rate the likelihood of this occurring?

• Low.
• Medium.
• High.
• There is not enough information for Alex to provide a rating.

Answer 12

High.

Alex knows that systems that are exposed to the Internet like screened subnet (DMZ) systems are constantly being scanned. She should rate the likelihood of the scan occurring as high. In fact, there is a good chance that a scan will be occurring while she is typing up her report!

Question 13

15- Lucy recently detected a cross‐site scripting (XSS) vulnerability in her organization’s web server. The organization operates a support forum where users can enter HTML tags and the resulting code is displayed to other site visitors. What type of cross‐site scripting vulnerability did Lucy discover?

• Persistent
• Reflected
• DOM‐based
• Blind

Answer 13

Persistent

This type of XSS vulnerability, where the attack is stored on a server for later users, is a persistent vulnerability. The scenario does not tell us that the code is immediately displayed to the user submitting it, so there is no indication of a reflected attack. The attack is stored on the server, rather than in the browser, so it is not a DOM‐based attack. Blind XSS attacks do not exist.

Question 14

Persistent XSS

Answer 14

also known as stored XSS attacks, occur when an attacker is able to store the attack code on a server, where it remains until a user requests the affected content

Question 15

Reflected XSS

Answer 15

when an attacker tricks a user into sending the attack to the server as part of a query string or other content, and the server then sends the attack back to the user, causing the code to execute

Question 16

DOM-based XSS

Answer 16

type of web security vulnerability where malicious code is executed in a user’s browser through manipulation of the Document Object Mode

Question 17

17- The company that Dan works for has recently migrated to an SaaS provider for its enterprise resource planning (ERP) software. In its traditional on‐site ERP environment, Dan conducted regular port scans to help with security validation for the systems. What will Dan most likely have to do in this new environment?

• Use a different scanning tool.
• Rely on vendor testing and audits.
• Engage a third‐party tester.
• Use a VPN to scan inside the vendor’s security perimeter.

Answer 17

Rely on vendor testing and audits.

Most SaaS providers do not want their customers conducting port scans of their service, and many are glad to provide security assertions and attestations including audits, testing information, or contractual language that addresses potential security issues. Using a different scanning tool, engaging a third‐party tester, or even using a VPN are not typically valid answers in a scenario like this.

Question 18

18- Which one of the following languages is least susceptible to an injection attack?

• HTML
• SQL
• STIX
• XML

Answer 18

STIX

STIX is a language used to define security threat information and is not a common target of injection attacks. SQL injection and XML injection attacks commonly take place against applications using those languages. Cross‐site scripting (XSS) attacks are a common example of an injection attack against HTML documents.

Question 19

19- Which one of the following types of malware would be most useful in a privilege escalation attack?

• Rootkit
• Worm
• Virus
• RAT

Answer 19

Rootkit

Rootkits are specifically designed for privilege escalation attacks, providing the ability to escalate a normal user account into an administrative account.

Question 20

ScoutSuite

Answer 20

This is an open-source multi-cloud security auditing tool that supports AWS, Azure, Google Cloud, and others. It provides security posture assessment across multiple cloud environments.

Question 21

Pacu

Answer 21

This is an AWS-specific exploitation framework designed for penetration testing and security assessment of AWS environments. It’s focused exclusively on AWS and doesn’t support Azure.

Question 22

Prowler

Answer 22

This is primarily an AWS security assessment tool that checks for CIS benchmarks and AWS best practices. While it’s excellent for AWS, it was originally designed specifically for AWS environments.

Question 23

CloudSploit

Answer 23

This is a multi-cloud security configuration scanner that supports AWS, Azure, Google Cloud, and others. It can detect misconfigurations across different cloud providers.

Question 24

21- Greg is concerned about the use of DDoS attack tools against his organization, so he purchased a mitigation service from his ISP. What portion of the threat model did Greg reduce?

• Likelihood
• Total attack surface
• Impact
• Adversary capability

Answer 24

Impact

By purchasing a mitigation service, Greg is reducing the potential impact of a DDoS attack. This service can’t reduce the likelihood that an attacker will launch an attack or the capability of that adversary. Greg did not change his own infrastructure, so he did not reduce the total attack surface.

Question 25

22- Carrie needs to lock down a Windows workstation that has recently been scanned using Nmap with the results shown here. She knows that the workstation needs to access websites and that the system is part of a Windows domain. What ports should she allow through the system’s firewall for externally initiated connections? Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-25 21:08 EDT Nmap scan report for dynamo (192.168.1.14) Host is up (0.00023s latency) Not shown: 65524 closed ports PORT STATE SERVICE 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 902/tcp open iss-realsecure 912/tcp open apex-mesh 2869/tcp open icslap 3389/tcp open ms-wbt-server 5357/tcp open wsdapi 7680/tcp open unknown 22350/tcp open CodeMeter 49677/tcp open unknown MAC Address: BC:5F:F4:7B:4B:7D (ASRock Incorporation) Nmap done: 1 IP address (1 host up) scanned in 105.78 seconds * 80, 135, 139, and 445. * 80, 445, and 3389. * 135, 139, and 445. * No ports should be open.

Answer 25

**No ports should be open.** The uses described for the workstation that Carrie is securing do not require inbound access to the system on any of these ports. Web browsing and Active Directory domain membership traffic can be handled by traffic initiated by the system.

Question 26

23- Adam’s port scan returns results on six TCP ports: 22, 80, 443, 515, 631, and 9100. If Adam needs to guess what type of device this is based on these ports, what is his best guess? * A web server * An FTP server * A printer * A proxy server

Answer 26

**A printer** Whereas the first three ports are common to many of the devices listed, TCP 515 is the LPR/LPD port, 631 is the IPP port commonly used by many print servers, and TCP port 9100 is the RAW, or direct, IP port. Although this could be another type of device, it is most likely a network‐connected printer.

Question 27

24- In his role as the SOC operator, Manish regularly scans a variety of servers in his organization. After two months of reporting multiple vulnerabilities on a Windows file server, Manish recently escalated the issue to the server administrator’s manager. At the next weekly scan window, Manish noticed that all the vulnerabilities were no longer active; however, ports 137, 139, and 445 were still showing as open. What most likely happened? * The server administrator blocked the scanner with a firewall. * The server was patched. * The vulnerability plug‐ins were updated and no longer report false positives. * The system was offline.

Answer 27

**The server was patched.** The system is showing normal ports for a Windows file server. It is most likely that Manish’s escalation to management resulted in action by the server administrator.

Question 28

25- While conducting reconnaissance, Piper discovers what she believes is an SMTP service running on an alternate port. What technique should she use to manually validate her guess? * Send an email via the open port. * Send an SMTP probe. * Telnet to the port. * SSH to the port.

Answer 28

**Telnet to the port.** Using telnet to connect to remote services to validate their response is a useful technique for service validation. It doesn’t always work, but it can allow you to interact with the service to gather information manually. While telnet is an insecure service and should not typically be used, the telnet command is a valuable way to test connectivity to an SMTP server. A more secure tool that uses encryption, such as SSH, would not provide visibility into the SMTP service because SMTP is not set up to accept SSH connections.

Question 29

26- Marta is a security analyst who has been tasked with performing Nmap scans of her organization’s network. She is a new hire and has been given this logical diagram of the organization’s network but has not been provided with any additional detail. (Look up the diagram in the book) * Scan the organization’s web server and then scan the other 255 IP addresses in its subnet. * Query DNS and WHOIS to find her organization’s registered hosts. * Contact ICANN to request the data. * Use traceroute to identify the network that the organization’s domain resides in.

Answer 29

**Query DNS and WHOIS to find her organization’s registered hosts.** Marta’s best option from this list is to query DNS using WHOIS. She might also choose to use a BGP looking glass, but most of the information she will need will be in WHOIS. If she simply scans the network the web server is in, she may end up scanning a third‐party hosting provider or other systems that aren’t owned by her organization in the /24 subnet range. Contacting ICANN isn’t necessary with access to WHOIS, and depending on what country Marta is in, ICANN may not have the data she wants. Finally, using traceroute will only show the IP address of the system she queries; she needs more data to perform a useful scan in most instances.

Question 30

27- Marta is a security analyst who has been tasked with performing Nmap scans of her organization’s network. She is a new hire and has been given this logical diagram of the organization’s network but has not been provided with any additional detail. (look up diagram in the book) * The scans will match. * Scans from location C will show no open ports. * Scans from location C will show fewer open ports. * Scans from location C will show more open ports.

Answer 30

**Scans from location C will show fewer open ports.** Scans from location C will show fewer open ports because most datacenter firewalls are configured to only allow the ports for publicly accessible services through to other networks. Location C is on an internal network, so Marta will probably see more ports than if she tried to scan datacenter systems from location A, but it is likely that she will see far fewer ports than a port scan of the datacenter from inside the datacenter firewall will show.

Question 31

28- Marta is a security analyst who has been tasked with performing Nmap scans of her organization’s network. She is a new hire and has been given this logical diagram of the organization’s network but has not been provided with any additional detail. (look up diagram in book) * Location A * Location B * Location C * Location D

Answer 31

**Location B** Marta will see the most important information about her organization at location B, which provides a view of datacenter servers behind the datacenter firewall. To get more information, she should request that the client network firewall ruleset include a rule allowing her scanner to scan through the firewall to all ports for all systems on all protocols.

Question 32

29- Chris wants to gather as much information as he can about an organization using DNS harvesting techniques. Which of the following methods will easily provide the most useful information if they are all possible to conduct on the network he is targeting? * DNS record enumeration * Zone transfer * Reverse lookup * Domain brute‐forcing

Answer 32

**Zone transfer** If Chris can perform a zone transfer, he can gather all of the organization’s DNS information, including domain servers, hostnames, MX and CNAME records, time to live records, zone serial number data, and other information. This is the easiest way to gather the most information about an organization via DNS if it is possible. Unfortunately, for penetration testers (and attackers!), few organizations allow untrusted systems to perform zone transfers. Nick: this is so stupid because zone transfers cannot be done by untrusted sources!

Question 33

30- Geoff wants to perform passive reconnaissance as part of an evaluation of his organization’s security controls. Which of the following techniques is a valid technique to perform as part of a passive DNS assessment? * A DNS forward or reverse lookup * A zone transfer * A WHOIS query * Using maltego

Answer 33

**A WHOIS query** Performing a WHOIS query is the only passive reconnaissance technique listed. Each of the other techniques performs an active reconnaissance task.

Question 34

Maltego

Answer 34

Maltego is a powerful OSINT visual link analysis and data mining tool used widely in cybersecurity, digital forensics, and intelligence analysis. It allows users to gather information about relationships between people, companies, websites, domains, IP addresses, and other entities from various public and private data sources

Question 35

34- Part of Tracy’s penetration testing assignment is to evaluate the WPA3 Enterprise protected wireless networks of her target organization. What major differences exist between reconnaissances of a wired network versus a wireless network? * Encryption and physical accessibility * Network access control and encryption * Port security and physical accessibility * Authentication and encryption

Answer 35

**Encryption and physical accessibility** Tracy knows that most wired networks do not use end‐to‐end encryption by default and that wireless networks are typically more easily accessible than a wired network that requires physical access to a network jack or a VPN connection from an authorized account. Without more detail, she cannot determine whether authentication is required for both networks, but NAC is a common security feature of wired networks, and WPA3 Enterprise requires authentication as well. Port security is used only for wired network connections.

Question 36

36- Lauren wants to identify all the printers on the subnets she is scanning with nmap. Which of the following nmap commands will not provide her with a list of likely printers? * nmap -sS -p 9100,515,631 10.0.10.15/22 -oX printers.txt * nmap -O 10.0.10.15/22 -oG - | grep printer >> printers.txt * nmap -sU -p 9100,515,631 10.0.10.15/22 -oX printers.txt * nmap -sS -O 10.0.10.15/22 -oG | grep >> printers.txt

Answer 36

**nmap -sU -p 9100,515,631 10.0.10.15/22 -oX printers.txt** Using a UDP scan, as shown in option C with the -sU flag, will not properly identify printers since print service ports are TCP ports. The other commands will properly scan and identify many printers based on either their service ports (515, 631, 9100) or their OS version.

Question 37

37- What services will the following nmap scan test for? nmap -sV -p 22,25,53,389 192.168.2.50/27 * Telnet, SMTP, DHCP, MS‐SQL * SSH, SMTP, DNS, LDAP * Telnet, SNMP, DNS, LDAP * SSH, SNMP, DNS, RDP

Answer 37

**SSH, SMTP, DNS, LDAP** This nmap scan will scan for SSH (22), SMTP (25), DNS (53), and LDAP (389) on their typical ports. If the services are running on an alternate port, this scan will completely miss those and any other services.

Question 38

39- Nihar wants to conduct an nmap scan of a firewalled subnet. Which of the following is not an nmap firewall evasion technique he could use? * Fragmenting packets * Changing packet header flags * Spoofing the source IP * Appending random data

Answer 38

**Changing packet header flags** nmap supports quite a few firewall evasion techniques including spoofing the MAC (hardware) address, appending random data, setting scan delays, using decoy IP addresses, spoofing the source IP or port, modifying the MTU size, or intentionally fragmenting packets.

Question 39

42- What occurs when Mia uses the following command to perform an nmap scan of a network? nmap -sP 192.168.2.0/24 * A secure port scan of all hosts in the 192.168.0.0 to 192.168.2.255 network range * A scan of all hosts that respond to ping in the 192.168.0.0 to 192.168.255.255 network range * A scan of all hosts that respond to ping in the 192.168.2.0 to 192.168.2.255 network range * A SYN‐based port scan of all hosts in the 192.168.2.0 to 192.168.2.255 network range

Answer 39

**A scan of all hosts that respond to ping in the 192.168.2.0 to 192.168.2.255 network range** The -sP flag for nmap indicates a ping scan, and /24 indicates a range of 255 addresses. In this case, that means nmap will scan for hosts that respond to ping in the 192.168.2.0 to 192.168.2.255 IP address range.

Question 40

43- Amir’s remote scans of a target organization’s class C network block using the nmap command (nmap -sS 10.0.10.1/24) show only a single web server. If Amir needs to gather additional reconnaissance information about the organization’s network, which of the following scanning techniques is most likely to provide additional detail? * Use a UDP scan. * Perform a scan from on‐site. * Scan using the -p 1-65535 flag. * Use Nmap’s IPS evasion techniques.

Answer 40

**Perform a scan from on‐site.** Performing a scan from an on‐site network connection is the most likely to provide more detail. Many organizations have a strong external network defense but typically provide fewer protections for on‐site network connections to allow internal users to access services. It is possible that the organization uses services found only on less common ports or UDP only services, but both of these options have a lower chance of being true than for an on‐site scan to succeed. Nmap does provide firewall and IPS evasion capabilities, but this is also a less likely scenario.

Question 41

44- Damian wants to limit the ability of attackers to conduct passive fingerprinting exercises on his network. Which of the following practices will help to mitigate this risk? * Implement an IPS. * Implement a firewall. * Disable promiscuous mode for NICs. * Enable promiscuous mode for NICs

Answer 41

**Disable promiscuous mode for NICs.** Passive fingerprinting relies on the ability of a system to capture traffic to analyze. Preventing systems from using promiscuous mode will provide attackers with very little data when performing passive fingerprinting. Both intrusion prevention systems and firewalls can help with active fingerprinting but will do nothing to stop passive fingerprinting.

Question 42

45- As part of his active reconnaissance activities, Frank is provided with a shell account accessible via SSH. If Frank wants to run a default nmap scan on the network behind the firewall shown here, how can he accomplish this? (look up diagram in book) * ssh -t 192.168.34.11 nmap 192.168.34.0/24 * ssh -R 8080:192.168.34.11:8080 [remote account:remote password] * ssh -proxy 192.168.11 [remote account:remote password] * Frank cannot scan multiple ports with a single ssh command.

Answer 42

**Frank cannot scan multiple ports with a single ssh command.** While SSH port forwarding and SSH tunneling are both useful techniques for pivoting from a host that allows access, nmap requires a range of ports open for default scans. He could write a script and forward the full range of ports that nmap checks, but none of the commands listed will get him there. If Frank has access to proxy chains, he could do this with two commands.

Question 43

47- Stacey encountered a system that shows as “filtered” and “firewalled” during an nmap scan. Which of the following techniques should she not consider as she is planning her next scan? * Packet fragmentation * Spoofing the source address * Using decoy scans * Spoofing the destination address

Answer 43

**Spoofing the destination address** nmap has a number of built‐in antifirewall capabilities, including packet fragmentation, decoy scans, spoofing of the source IP address and source port, and scan timing techniques that make detection less likely. Spoofing the target IP address won’t help; her packets still need to get to the actual target.

Question 44

50- Sadiq is responsible for the security of a network used to control systems within his organization’s manufacturing plant. The network connects manufacturing equipment, sensors, and controllers. He runs a vulnerability scan on this network and discovers that several of the controllers are running out‐of‐date firmware that introduces security issues. The manufacturer of the controllers is out of business. What action can Sadiq take to best remediate this vulnerability in an efficient manner? * Develop a firmware update internally and apply it to the controllers. * Post on an Internet message board seeking other organizations that have developed a patch. * Ensure that the ICS is on an isolated network. * Use an intrusion prevention system on the ICS network.

Answer 44

**Ensure that the ICS is on an isolated network.** Sadiq should ensure that the industrial control system (ICS) is on an isolated network, unreachable from any Internet‐connected system. This greatly reduces the risk of exploitation. It would not be cost‐effective to develop a patch himself, and Sadiq should not trust any software that he obtains from an Internet forum. An intrusion prevention system, while a good idea, is not as strong a control as network isolation.

Question 45

56- George recently ran a port scan on a network device used by his organization. Which one of the following open ports represents the most significant possible security vulnerability? * 22 * 23 * 161 * 443

Answer 45

**23** Port 23 is used by telnet, an insecure unencrypted communications protocol. George should ensure that telnet is disabled and blocked. Secure shell (SSH) runs on port 22 and serves as a secure alternative. Port 161 is used by the Simple Network Management Protocol (SNMP), and port 443 (HTTPS) is used for secure web connections.

Question 46

61- Quentin ran a vulnerability scan of a server in his organization and discovered the results shown here. Which one of the following actions is not required to resolve one of the vulnerabilities on this server? (look up diagram in book) * Reconfigure cipher support. * Apply Window security patches. * Obtain a new SSL certificate. * Enhance account security policies.

Answer 46

**Apply Window security patches.** Quentin should reconfigure cipher support to resolve the issues surrounding the weak cipher support of SSL/TLS and RDP. He should also obtain a new SSL certificate to resolve multiple issues with the current certificate. He should add account security requirements to resolve the naming of guest accounts and the expiration of administrator passwords. There is no indication that any Windows patches are missing on this system.

Question 47

62- The presence of ____________ triggers specific vulnerability scanning requirements based on law or regulation. * Credit card information * Protected health information * Personally identifiable information * Trade secret information

Answer 47

**Credit card information** Although all of these categories of information should trigger vulnerability scanning for assets involved in their storage, processing, or transmission, only credit card information has specific regulations covering these scans. The Payment Card Industry Data Security Standard (PCI DSS) contains detailed requirements for vulnerability scanning.

Question 48

67- This morning, Eric ran a vulnerability scan in an attempt to detect a vulnerability that was announced by a software manufacturer yesterday afternoon. The scanner did not detect the vulnerability although Eric knows that at least two of his servers should have the issue. Eric contacted the vulnerability scanning vendor, who assured him that they released a signature for the vulnerability overnight. What should Eric do as a next step? * Check the affected servers to verify a false positive. * Check the affected servers to verify a false negative. * Report a bug to the vendor. * Update the vulnerability signatures.

Answer 48

**Update the vulnerability signatures.** The most likely issue is that Eric’s scanner has not pulled the most recent signatures from the vendor’s vulnerability feed. Eric should perform a manual update and rerun the scan before performing an investigation of the servers in question or filing a bug report.

Question 49

68- Natalie ran a vulnerability scan of a web application recently deployed by her organization, and the scan result reported a blind SQL injection. She reported the vulnerability to the developers, who scoured the application and made a few modifications but did not see any evidence that this attack was possible. Natalie reran the scan and received the same result. The developers are now insisting that their code is secure. What is the most likely scenario? * The result is a false positive. * The code is deficient and requires correction. * The vulnerability is in a different web application running on the same server. * Natalie is misreading the scan report.

Answer 49

**The result is a false positive.** Blind SQL injection vulnerabilities are difficult to detect and are a notorious source of false positive reports. Natalie should verify the results of the tests performed by the developers but should be open to the possibility that this is a false positive report, since that is the most likely scenario.

Question 50

70- Joaquin is frustrated at the high level of false positive reports produced by his vulnerability scans and is contemplating a series of actions designed to reduce the false positive rate. Which one of the following actions is least likely to have the desired effect? Moving to credentialed scanning Moving to agent‐based scanning Integrating asset information into the scan Increasing the sensitivity of scans

Answer 50

**Increasing the sensitivity of scans** Joaquin can improve the quality and quantity of information available to the scanner by moving to credentialed scanning, moving to agent‐based scanning, and integrating asset information into the scans. Any of these actions is likely to reduce the false positive rate. Increasing the sensitivity of scans would likely have the opposite effect, causing the scanner to report even more false positives.

Question 51

73- Zara is prioritizing vulnerability scans and would like to base the frequency of scanning on the information asset value. Which of the following criteria would be most appropriate for her to use in this analysis? * Cost of hardware acquisition * Cost of hardware replacement * Types of information processed * Depreciated hardware cost

Answer 51

**Types of information processed** Information asset value refers to the value that the organization places on data stored, processed, or transmitted by an asset. In this case, the types of information processed (e.g., regulated data, intellectual property, personally identifiable information) helps to determine information asset value. The cost of server acquisition, cost of hardware replacement, and depreciated cost all refer to the financial value of the hardware, which is a different concept than information asset value.

Question 52

Information Asset Value

Answer 52

refers to the value that an organization places on **data that is stored, processed, or transmitted by an asset**

Question 53

84- Morgan is interpreting the vulnerability scan from her organization’s network, shown here. She would like to determine which vulnerability to remediate first. Morgan would like to focus on vulnerabilities that are most easily exploitable by someone outside her organization. Assuming the firewall is properly configured, which one of the following vulnerabilities should Morgan give the highest priority? (see diagram in book) * Severity 5 vulnerability in the workstation * Severity 1 vulnerability in the file server * Severity 5 vulnerability in the web server * Severity 1 vulnerability in the mail server

Answer 53

**Severity 5 vulnerability in the web server** If the firewall is properly configured, the workstation and file server are not accessible by an external attacker. Of the two remaining choices, the web server vulnerability (at severity 5) is more severe than the mail server vulnerability (at severity 1). Most organizations do not bother to remediate severity 1 vulnerabilities because they are usually informational in nature.

Question 54

88- Which one of the following protocols is not likely to trigger a vulnerability scan alert when used to support a virtual private network (VPN)? * IPsec * SSL v2 * PPTP * SSL v3

Answer 54

**IPsec** IPsec is a secure protocol for establishing VPN links. Organizations should no longer use the obsolete Secure Sockets Layer (SSL) or Point‐to‐Point Tunneling Protocol (PPTP) for VPN connections or other secure connections.

Question 55

89- Rahul ran a vulnerability scan of a server that will be used for credit card processing in his environment and received a report containing the vulnerability shown here. What action must Rahul take? (look up diagram in book) * Remediate the vulnerability when possible. * Remediate the vulnerability prior to moving the system into production and rerun the scan to obtain a clean result. * Remediate the vulnerability within 90 days of moving the system to production. * No action is required.

Answer 55

**No action is required.** Rahul does not need to take any action on this vulnerability because it has a severity rating of 2 on a five‐point scale. PCI DSS only requires the remediation of vulnerabilities with at least a “high” rating, and this vulnerability does not clear that threshold.

Question 56

91- Aaron is scanning a server in his organization’s datacenter and receives the vulnerability report shown here. The service is exposed only to internal hosts. (look up diagram in book) What priority should Aaron place on remediating this vulnerability? * Aaron should make this vulnerability his highest priority. * Aaron should remediate this vulnerability urgently but does not need to drop everything. * Aaron should remediate this vulnerability within the next month. * Aaron does not need to assign any priority to remediating this vulnerability.

Answer 56

**Aaron does not need to assign any priority to remediating this vulnerability.** Aaron should treat this vulnerability as a fairly low priority and may never get around to remediating it if there are more critical issues on his network. The vulnerability has a severity rating of 2 (out of 5), and the vulnerability is further mitigated by the fact that the server is accessible only from the local network.

Question 57

92- Without access to any additional information, which one of the following vulnerabilities would you consider the most severe if discovered on a production web server? * CGI generic SQL injection * Web application information disclosure * Web server uses basic authentication without HTTPS * Web server directory enumeration

Answer 57

**CGI generic SQL injection** The SQL injection attack could be quite serious, since it may allow an attacker to retrieve and/or modify information stored in the back‐end database. The second‐highest priority should be resolving the use of unencrypted authentication, because it may allow the theft of user credentials. The remaining two vulnerabilities are less serious, because they pose only a reconnaissance risk. *Nick: Not sure I agree with this, as if you get creds, you can get into the DB. Soooo how is that worse?*

Question 58

93- Gina ran a vulnerability scan on three systems that her organization is planning to move to production and received the results shown here. How many of these issues should Gina require be resolved before moving to production? (look up diagram in book) * 0. * 1. * 3. * All of these issues should be resolved.

Answer 58

**0** The report notes that all of the vulnerabilities for these three servers are in Fixed status. This indicates that the vulnerabilities existed but have already been remediated and no additional work is required.

Question 59

94- Ji‐won recently restarted an old vulnerability scanner that had not been used in more than a year. She booted the scanner, logged in, and configured a scan to run. After reading the scan results, she found that the scanner was not detecting known vulnerabilities that were detected by other scanners. What is the most likely cause of this issue? * The scanner is running on an outdated operating system. * The scanner’s maintenance subscription is expired. * Ji‐won has invalid credentials on the scanner. * The scanner does not have a current, valid IP address.

Answer 59

**The scanner’s maintenance subscription is expired.** The most likely issue is that the maintenance subscription for the scanner expired while it was inactive and the scanner is not able to retrieve current signatures from the vendor’s vulnerability feed. The operating system of the scanner should not affect the scan results. Ji‐won would not be able to access the scanner at all if she had invalid credentials or the scanner had an invalid IP address.

Question 60

95- Isabella runs both internal and external vulnerability scans of a web server and detects a possible SQL injection vulnerability. The vulnerability appears only in the internal scan and does not appear in the external scan. When Isabella checks the server logs, she sees the requests coming from the internal scan and sees some requests from the external scanner but no evidence that a SQL injection exploit was attempted by the external scanner. What is the most likely explanation for these results? * A host firewall is blocking external network connections to the web server. * A network firewall is blocking external network connections to the web server. * A host IPS is blocking some requests to the web server. * A network IPS is blocking some requests to the web server.

Answer 60

**A network IPS is blocking some requests to the web server.** The most likely scenario is that a network IPS is blocking SQL injection attempts sent to this server, and the internal scanner is positioned on the network in such a way that it is not filtered by the network IPS. If a host IPS were blocking the requests, the vulnerability would likely not appear on internal scans either. If a firewall were blocking the requests, then no external scanner entries would appear in the log file.

Question 61

96- Rick discovers the vulnerability shown here in a server running in his datacenter. What characteristic of this vulnerability should concern him the most? (look up diagram in book) * It is the subject of a recent security bulletin. * It has a CVSS score of 7.8. * There are multiple Bugtraq and CVE IDs. * It affects kernel‐mode drivers.

Answer 61

**It affects kernel‐mode drivers.** The fact that this vulnerability affects kernel‐mode drivers is very serious, because it indicates that an attacker could compromise the core of the operating system in an escalation of privilege attack. The other statements made about this vulnerability are all correct, but they are not as serious as the kernel‐mode issue.

Question 62

97- Carl runs a vulnerability scan of a mail server used by his organization and receives the vulnerability report shown here. What action should Carl take to correct this issue? (look up diagram in book) * Carl does not need to take any action because this is an informational report. * Carl should replace SSL with TLS on this server. * Carl should disable weak ciphers. * Carl should upgrade OpenSSL.

Answer 62

**Carl should upgrade OpenSSL.** This is an example of the POODLE vulnerability that exploits weaknesses in the OpenSSL encryption library. While replacing SSL with TLS and disabling weak ciphers are good practices, they will not correct this issue. Carl should upgrade OpenSSL to a more current version that does not contain this vulnerability.

Question 63

102- After reviewing the results of a vulnerability scan, Gabriella discovered a flaw in her Oracle database server that may allow an attacker to attempt a direct connection to the server. She would like to review NetFlow logs to determine what systems have connected to the server recently. What TCP port should Gabriella expect to find used for this communication? * 443 * 1433 * 1521 * 8080

Answer 63

**1521** Oracle database servers use port 1521 for database connections. Port 443 is used for HTTPS connections to a web server. Microsoft SQL Server uses port 1433 for database connections. Port 8080 is a nonstandard port for web services.

Question 64

103- Terry recently ran a vulnerability scan against his organization’s credit card processing environment that found a number of vulnerabilities. Which vulnerabilities must he remediate to have a “clean” scan under PCI DSS standards? * Critical vulnerabilities * Critical and high vulnerabilities * Critical, high, and medium vulnerabilities * Critical, high, medium, and low vulnerabilities

Answer 64

**Critical and high vulnerabilities** The PCI DSS standard requires that merchants and service providers present a clean scan result that shows no critical or high vulnerabilities in order to maintain compliance.

Question 65

Network Classes

Answer 65

* Class A: Subnet Mask: 255.0.0.0 (8 bits); CIDR: /8 * Class B: Subnet Mask: 255.255.0.0 (16 bits); CIDR: /16 * Class C: Subnet Mask: 255.255.255.0 (24 bits); CIDR: /24 * Class D: Subnet Mask: 255.255.255.255 (32 bits); CIDR: /32

Question 66

105- Aaron is configuring a vulnerability scan for a Class C network and is trying to choose a port setting from the list shown here. He would like to choose a scan option that will efficiently scan his network but also complete in a reasonable period of time. Which setting would be most appropriate? (look up diagram in the book) * None * Full * Standard Scan * Light Scan

Answer 66

**Standard Scan** The standard scan of 1,900 common ports is a reasonably thorough scan that will conclude in a realistic period of time. If Aaron knows of specific ports used in his organization that are not included in the standard list, he could specify them using the Additional section of the port settings. A full scan of all 65,535 ports would require an extremely long period of time on a Class C network. Choosing the Light Scan setting would exclude a large number of commonly used ports, whereas the None setting would not scan any ports.

Question 67

106- Haruto is reviewing the results of a vulnerability scan, shown here, from a web server in his organization. Access to this server is restricted at the firewall so that it may not be accessed on port 80 or 443. Which of the following vulnerabilities should Haruto still address? (look up diagram in the book) * OpenSSL version. * Cookie information disclosure. * TRACK/TRACE methods. * Haruto does not need to address any of these vulnerabilities because they are not exposed to the outside world.

Answer 67

**OpenSSL version.** From the information given in the scenario, you can conclude that all of the HTTP/HTTPS vulnerabilities are not exploitable by an attacker because of the firewall restrictions. However, OpenSSL is an encryption package used for other services, in addition to HTTPS. Therefore, it may still be exposed via SSH or other means. Haruto should replace it with a current, supported version because running an end‐of‐life (EOL) version of this package exposes the organization to potentially unpatchable security vulnerabilities.

Question 68

107- Brian is considering the use of several different categories of vulnerability plug‐ins. Of the types listed here, which is the most likely to result in false positive reports? * Registry inspection * Banner grabbing * Service interrogation * Fuzzing

Answer 68

**Banner grabbing** Banner grabbing scans are notorious for resulting in false positive reports because the only validation they do is to check the version number of an operating system or application against a list of known vulnerabilities. This approach is unable to detect any remediation activities that may have taken place that do not alter the version number.

Question 69

108- Binh conducts a vulnerability scan and finds three different vulnerabilities, with the CVSS scores shown here. Which vulnerability should be his highest priority to fix, assuming all three fixes are of equal difficulty? Vulnerability 1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Vulnerability 2 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Vulnerability 3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H * Vulnerability 1. * Vulnerability 2. * Vulnerability 3. * Vulnerabilities 1 and 3 are equal in priority.

Answer 69

**Vulnerability 3.** Vulnerability 3 has a CVSS score of 10.0 because it received the highest possible ratings on all portions of the CVSS vector. All three vulnerabilities have ratings of “high” for the confidentiality, integrity, and availability impact metrics. Vulnerabilities 1 and 2 have lower values for one or more of the exploitability metrics, meaning that weaponization of those vulnerabilities would likely be more difficult.

Question 70

CVSS metrics and options

Answer 70

Attack Vector (AV) - How the vulnerability is exploited: * N: Network - Exploitable remotely across a network * A: Adjacent - Requires access to local network * L: Local - Requires local access to the system * P: Physical - Requires physical access to the system Attack Complexity (AC) - Conditions beyond the attacker's control: * L: Low - No special conditions needed * H: High - Special conditions required Privileges Required (PR) - Level of privileges needed: * N: None - No privileges required * L: Low - Basic user privileges required * H: High - Administrative privileges required User Interaction (UI) - Whether a user must participate: * N: None - No user interaction required * R: Required - User interaction needed Scope (S) - Whether the vulnerability impacts resources beyond its security scope: * U: Unchanged - Affects only resources managed by the same authority * C: Changed - Can affect resources beyond the vulnerable component Confidentiality (C) - Impact to data confidentiality: * N: None - No impact * L: Low - Limited impact * H: High - Total information disclosure Integrity (I) - Impact to data or system integrity: * N: None - No impact * L: Low - Limited modification possible * H: High - Total compromise of system integrity Availability (A) - Impact to system availability: * N: None - No impact * L: Low - Reduced performance or interruptions * H: High - Total shutdown of the affected resource

Question 71

Landon is preparing to run a vulnerability scan of a dedicated Apache server that his organization is planning to move into a screened subnet (DMZ). Which one of the following vulnerability scans is least likely to provide informative results? * Web application vulnerability scan * Database vulnerability scan * Port scan * Network vulnerability scan

Answer 71

**Database vulnerability scan** There is no indication in the scenario that the server is running a database; in fact, the scenario indicates that the server is dedicated to running the Apache web service. Therefore, it is unlikely that a database vulnerability scan would yield any results. Landon should run the other three scans, and if they indicate the presence of a database server, he could follow up with a specialized database vulnerability scan.

Question 72

Nonrepudiation

Answer 72

**property that prevents someone from denying they performed an action like sending a message or signing a document**. It's typically implemented using digital signatures, secure timestamps, and audit logs to provide verifiable proof of who did what and when.

Question 73

112- Aadesh is creating a vulnerability management program for his company. He has limited scanning resources and would like to apply them to different systems based on the sensitivity and criticality of the information that they handle. What criteria should Aadesh use to determine the vulnerability scanning frequency? * Data remanence * Data privacy * Data classification * Data sovereignty

Answer 73

**Data classification** Data classification is a set of labels applied to information based on their degree of sensitivity and/or criticality. It would be the most appropriate choice in this scenario. Data retention requirements dictate the length of time that an organization should maintain copies of records. Data remanence is an issue where information thought to be deleted may still exist on systems. Data privacy may contribute to data classification but does not encompass the entire field of data sensitivity and criticality in the same manner as data classification. For example, a system may process proprietary business information that would be very highly classified and require frequent vulnerability scanning. Unless that system also processed personally identifiable information, it would not trigger scans under a system based solely on data privacy.

Question 74

116- Yashvir runs the cybersecurity vulnerability management program for his organization. He sends a database administrator a report of a missing database patch that corrects a high severity security issue. The DBA writes back to Yashvir that he has applied the patch. Yashvir reruns the scan, and it still reports the same vulnerability. What should he do next? * Mark the vulnerability as a false positive. * Ask the DBA to recheck the database server. * Mark the vulnerability as an exception. * Escalate the issue to the DBA’s manager.

Answer 74

**Ask the DBA to recheck the database server.** In this case, Yashvir should ask the DBA to recheck the server to ensure that the patch was properly applied. It is not yet appropriate to mark the issue as a false positive report until Yashvir performs a brief investigation to confirm that the patch is applied properly. This is especially true because the vulnerability relates to a missing patch, which is not a common source of false positive reports. There was no acceptance of this vulnerability, so Yashvir should not mark it as an exception. He should not escalate this issue to management because the DBA is working with him in good faith.

Question 75

117- Manya is reviewing the results of a vulnerability scan and identifies the issue shown here in one of her systems. She consults with developers who check the code and assure her that it is not vulnerable to SQL injection attacks. An independent auditor confirms this for Manya. What is the most likely scenario? Here's the transcription of the image: HIGH CGI Generic SQL Injection (blind, time based) > Description By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database. An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system. Note that this script is experimental and may be prone to false positives. Solution Modify the affected CGI scripts so that they properly escape arguments. * This is a false positive report. * The developers are wrong, and the vulnerability exists. * The scanner is malfunctioning. * The database server is misconfigured.

Answer 75

**This is a false positive report.** This is most likely a false positive report. The vulnerability description says “note that this script is experimental and may be prone to false positives.” It is less likely that the developers and independent auditors are all incorrect. The scanner is most likely functioning properly, and there is no indication that either it or the database server is misconfigured.

Question 76

119- Larry recently discovered a critical vulnerability in one of his organization’s database servers during a routine vulnerability scan. When he showed the report to a database administrator, the administrator responded that they had corrected the vulnerability by using a vendor‐supplied workaround because upgrading the database would disrupt an important process. Larry verified that the workaround is in place and corrects the vulnerability. How should Larry respond to this situation? * Mark the report as a false positive. * Insist that the administrator apply the vendor patch. * Mark the report as an exception. * Require that the administrator submit a report describing the workaround after each vulnerability scan.

Answer 76

**Mark the report as a false positive.** This is an example of a false positive report. The administrator demonstrated that the database is not subject to the vulnerability because of the workaround, and Larry went a step further and verified this himself. Therefore, he should mark the report as a false positive in the vulnerability scanner.

Question 77

120- Larry recently discovered a critical vulnerability in one of his organization’s database servers during a routine vulnerability scan. When he showed the report to a database administrator, the administrator responded that they had corrected the vulnerability by using a vendor‐supplied workaround because upgrading the database would disrupt an important process. Larry verified that the workaround is in place and corrects the vulnerability. What is the most likely cause of this report? * The vulnerability scanner requires an update. * The vulnerability scanner depends on version detection. * The database administrator incorrectly applied the workaround. * Larry misconfigured the scan.

Answer 77

**The vulnerability scanner depends on version detection.** False positive reports like the one described in this scenario are common when a vulnerability scanner depends on banner grabbing and version detection. The primary solution to this issue is applying a patch that the scanner would detect by noting a new version number. However, the administrator performed the perfectly acceptable action of remediating the vulnerability in a different manner without applying the patch, but the scanner is unable to detect that remediation activity and is reporting a false positive result.

Question 78

122- Margot discovered that a server in her organization has a SQL injection vulnerability. She would like to investigate whether attackers have attempted to exploit this vulnerability. Which one of the following data sources is least likely to provide helpful information? * NetFlow logs * Web server logs * Database logs * IDS logs

Answer 78

**NetFlow logs** Margot can expect to find relevant results in the web server logs because they would contain records of HTTP requests to the server. Database server logs would contain records of the queries made against the database. IDS logs may contain logs of SQL injection alerts. NetFlow logs would not contain useful information because they record only traffic flows, not the details of the communications.

Question 79

123- Krista is reviewing a vulnerability scan report and comes across the vulnerability shown here. She comes from a Linux background and is not as familiar with Windows administration. She is not familiar with the runas command mentioned in this vulnerability. What is the closest Linux equivalent command? (Look up diagram in book) * sudo * grep * su * ps

Answer 79

**sudo** The runas command allows an administrator to execute a command using the privileges of another user. Linux offers the same functionality with the sudo command. The Linux su command is similar but allows an administrator to switch user identities, rather than simply execute a command using another user’s identity. The ps command in Linux lists active processes, whereas the grep command is used to search for text matching a pattern.

Question 80

126- Akari scans a Windows server in her organization and finds that it has multiple critical vulnerabilities, detailed in the report shown here. What action can Akari take that will have the most significant impact on these issues without creating a long‐term outage? (Look up diagram in book) * Configure the host firewall to block inbound connections. * Apply security patches. * Disable the guest account on the server. * Configure the server to only use secure ciphers.

Answer 80

**Apply security patches.** The majority of the most serious issues in this scan report relate to missing security updates to Windows and applications installed on the server. Akari should schedule a short outage to apply these updates. Blocking inbound connections at the host firewall would prevent the exploitation of these vulnerabilities, but it would also prevent users from accessing the server. Disabling the guest account and configuring the use of secure ciphers would correct several vulnerabilities, but they are not as severe as the vulnerabilities related to patches.

Question 81

128- Doug is preparing an RFP for a vulnerability scanner for his organization. He needs to know the number of systems on his network to help determine the scanner requirements. Which one of the following would not be an easy way to obtain this information? * ARP tables * Asset management tool * Discovery scan * Results of scans recently run by a consultant

Answer 81

**ARP tables** Although ARP tables may provide the necessary information, this is a difficult way to enumerate hosts and is prone to error. Doug would have much greater success if he consulted the organization’s asset management tool, ran a discovery scan, or looked at the results of other recent scans.

Question 82

129- Mary runs a vulnerability scan of her entire organization and shares the report with another analyst on her team. An excerpt from that report appears here. Her colleague points out that the report contains only vulnerabilities with severities of 3, 4, or 5. What is the most likely cause of this result? (Look up diagram in book) The scan sensitivity is set to exclude low‐importance vulnerabilities. Mary did not configure the scan properly. Systems in the datacenter do not contain any level 1 or 2 vulnerabilities. The scan sensitivity is set to exclude high‐impact vulnerabilities.

Answer 82

**The scan sensitivity is set to exclude low‐importance vulnerabilities.** The most likely reason for this result is that the scan sensitivity is set to exclude low‐impact vulnerabilities rated as 1 or 2. There is no reason to believe that Mary configured the scan improperly because this is a common practice to limit information overload and is likely intentional. It is extremely unlikely that systems in the datacenter contain no low‐impact vulnerabilities when they have high‐impact vulnerabilities. If Mary excluded high‐impact vulnerabilities, the report would not contain any vulnerabilities rated 4 or 5.

Question 83

131- Which one of the following approaches provides the most current and accurate information about vulnerabilities present on a system because of the misconfiguration of operating system settings? * On‐demand vulnerability scanning * Continuous vulnerability scanning * Scheduled vulnerability scanning * Agent‐based monitoring

Answer 83

**Agent‐based monitoring** Vulnerability scans can only provide a snapshot in time of a system’s security status from the perspective of the vulnerability scanner. Agent‐based monitoring provides a detailed view of the system’s configuration from an internal perspective and is likely to provide more accurate results, regardless of the frequency of vulnerability scanning.

Question 84

GPO

Question 85

133- Pete recently conducted a broad vulnerability scan of all the servers and workstations in his environment. He scanned the following three networks: Screened subnet (DMZ) network that contains servers with public exposure Workstation network that contains workstations that are allowed outbound access only Internal server network that contains servers exposed only to internal systems He detected the following vulnerabilities: Vulnerability 1: A SQL injection vulnerability on a screened subnet (DMZ) server that would grant access to a database server on the internal network (severity 5/5) Vulnerability 2: A buffer overflow vulnerability on a domain controller on the internal server network (severity 3/5) Vulnerability 3: A missing security patch on several hundred Windows workstations on the workstation network (severity 2/5) Vulnerability 4: A denial‐of‐service vulnerability on a screened subnet (DMZ) server that would allow an attacker to disrupt a public‐facing website (severity 2/5) Vulnerability 5: A denial‐of‐service vulnerability on an internal server that would allow an attacker to disrupt an internal website (severity 4/5) Note that the severity ratings assigned to these vulnerabilities are directly from the vulnerability scanner and were not assigned by Pete. Pete is working with the desktop support manager to remediate vulnerability 3. What would be the most efficient way to correct this issue? * Personally visit each workstation to remediate the vulnerability. * Remotely connect to each workstation to remediate the vulnerability. * Perform registry updates using a remote configuration tool. * Apply the patch using a GPO.

Answer 85

**Apply the patch using a GPO.** Pete and the desktop support team should apply the patch using a Group Policy Object (GPO) or other centralized configuration management tool. This is much more efficient than visiting each workstation individually, either in person or via remote connection. There is no indication in the scenario that a registry update would remediate this issue.

Question 86

134- Pete recently conducted a broad vulnerability scan of all the servers and workstations in his environment. He scanned the following three networks: Screened subnet (DMZ) network that contains servers with public exposure Workstation network that contains workstations that are allowed outbound access only Internal server network that contains servers exposed only to internal systems He detected the following vulnerabilities: Vulnerability 1: A SQL injection vulnerability on a screened subnet (DMZ) server that would grant access to a database server on the internal network (severity 5/5) Vulnerability 2: A buffer overflow vulnerability on a domain controller on the internal server network (severity 3/5) Vulnerability 3: A missing security patch on several hundred Windows workstations on the workstation network (severity 2/5) Vulnerability 4: A denial‐of‐service vulnerability on a screened subnet (DMZ) server that would allow an attacker to disrupt a public‐facing website (severity 2/5) Vulnerability 5: A denial‐of‐service vulnerability on an internal server that would allow an attacker to disrupt an internal website (severity 4/5) Note that the severity ratings assigned to these vulnerabilities are directly from the vulnerability scanner and were not assigned by Pete. Pete recently conferred with the organization’s CISO, and the team is launching an initiative designed to combat the insider threat. They are particularly concerned about the theft of information by employees seeking to exceed their authorized access. Which one of the vulnerabilities in this report is of greatest concern given this priority? * Vulnerability 2 * Vulnerability 3 * Vulnerability 4 * Vulnerability 5

Answer 86

**Vulnerability 2** An insider would have the network access required to connect to a system on the internal server network and exploit this buffer overflow vulnerability. Buffer overflow vulnerabilities typically allow the execution of arbitrary code, which may allow an attacker to gain control of the server and access information above their authorization level. Vulnerability 3 may also allow the theft of information, but it has a lower severity level than vulnerability 2. Vulnerabilities 4 and 5 are denial‐of‐service vulnerabilities that would allow the disruption of service, not the theft of information.

Question 87

135- Wanda recently discovered the vulnerability shown here on a Windows server in her organization. She is unable to apply the patch to the server for six weeks because of operational issues. What workaround would be most effective in limiting the likelihood that this vulnerability would be exploited? (Look up diagram in book) * Restrict interactive logins to the system. * Remove Microsoft Office from the server. * Remove Internet Explorer from the server. * Apply the security patch.

Answer 87

**Restrict interactive logins to the system.** Wanda should restrict interactive logins to the server. The vulnerability report states that “The most severe of these vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.” If Wanda restricts interactive login, it greatly reduces the likelihood of this type of activity. Removing Internet Explorer or Microsoft Office might lower some of the risk, but it would not be as effective as completely restricting logins. Applying the security patch is not an option because of the operational concerns cited in the question.

Question 88

136- Garrett is configuring vulnerability scanning for a new web server that his organization is deploying on its screened subnet (DMZ) network. The server hosts the company’s public website. What type of scanning should Garrett configure for best results? * Garrett should not perform scanning of screened subnet (DMZ) systems. * Garrett should perform external scanning only. * Garrett should perform internal scanning only. * Garrett should perform both internal and external scanning.

Answer 88

**Garrett should perform both internal and external scanning.** For best results, Garret should combine both internal and external vulnerability scans. The external scan provides an “attacker’s eye view” of the web server, whereas the internal scan may uncover vulnerabilities that would only be exploitable by an insider or an attacker who has gained access to another system on the network.

Question 89

137- rank recently ran a vulnerability scan and identified a POS terminal that contains an unpatchable vulnerability because of running an unsupported operating system. Frank consults with his manager and is told that the POS is being used with full knowledge of management and, as a compensating control, it has been placed on an isolated network with no access to other systems. Frank’s manager tells him that the merchant bank is aware of the issue. How should Frank handle this situation? * Document the vulnerability as an approved exception. * Explain to his manager that PCI DSS does not permit the use of unsupported operating systems. * Decommission the POS system immediately to avoid personal liability. * Upgrade the operating system immediately.

Answer 89

**Document the vulnerability as an approved exception.** The scenario describes an acceptable use of a compensating control that has been reviewed with the merchant bank. Frank should document this as an exception and move on with his scans. Other actions would go against his manager’s wishes and are not required by the situation.

Question 90

140- Julian recently detected the vulnerability shown here on several servers in his environment. Because of the critical nature of the vulnerability, he would like to block all access to the affected service until it is resolved using a firewall rule. He verifies that the following TCP ports are open on the host firewall. Which one of the following does Julian not need to block to restrict access to this service? (Look up diagram in book) * 137 * 139 * 389 * 445

Answer 90

**389** Port 389 is used by the Lightweight Directory Access Protocol (LDAP) and is not part of the SMB communication. SMB may be accessed directly over TCP port 445 or indirectly by using NetBIOS over TCP/IP on TCP ports 137 and 139.

Question 91

144- Victor is configuring a new vulnerability scanner. He set the scanner to run scans of his entire datacenter each evening. When he went to check the scan reports at the end of the week, he found that they were all incomplete. The scan reports noted the error “Scan terminated due to start of preempting job.” Victor has no funds remaining to invest in the vulnerability scanning system. He does want to cover the entire datacenter. What should he do to ensure that scans complete? * Reduce the number of systems scanned. * Increase the number of scanners. * Upgrade the scanner hardware. * Reduce the scanning frequency.

Answer 91

**Reduce the scanning frequency.** The problem Victor is experiencing is that the full scan does not complete in the course of a single day and is being cancelled when the next full scan tries to run. He can fix this problem by reducing the scanning frequency. For example, he could set the scan to run once a week so that it completes. Reducing the number of systems scanned would not meet his requirement to scan the entire datacenter. He cannot increase the number of scanners or upgrade the hardware because he has no funds to invest in the system

Question 92

146- Terry is reviewing a vulnerability scan of a Windows server and came across the vulnerability shown here. What is the risk presented by this vulnerability? (look up diagram in book) * An attacker may be able to execute a buffer overflow and execute arbitrary code on the server. * An attacker may be able to conduct a denial‐of‐service attack against this server. * An attacker may be able to determine the operating system version on this server. * There is no direct vulnerability, but this information points to other possible vulnerabilities on the server.

Answer 92

**There is no direct vulnerability, but this information points to other possible vulnerabilities on the server.** This scan result does not directly indicate a vulnerability. However, it does indicate that the server is configured for compatibility with 16‐bit applications, and those applications may have vulnerabilities. It is an informational result that does not directly require action on Terry’s behalf.

Question 93

147- Andrea recently discovered the vulnerability shown here on the workstation belonging to a system administrator in her organization. What is the major likely threat that should concern Andrea? (look up diagram in book) * An attacker could exploit this vulnerability to take control of the administrator’s workstation. * An attacker could exploit this vulnerability to gain access to servers managed by the administrator. * An attacker could exploit this vulnerability to prevent the administrator from using the workstation. * An attacker could exploit this vulnerability to decrypt sensitive information stored on the administrator’s workstation.

Answer 93

**An attacker could exploit this vulnerability to gain access to servers managed by the administrator.** PuTTY is a commonly used remote login application used by administrators to connect to servers and other networked devices. If an attacker gains access to the SSH private keys used by PuTTY, the attacker could use those keys to gain access to the systems managed by that administrator. This vulnerability does not necessarily give the attacker any privileged access to the administrator’s workstation, and the SSH key is not normally used to encrypt stored information.

Question 94

149- Chandra’s organization recently upgraded the firewall protecting the network where they process credit card information. This network is subject to the provisions of PCI DSS. When is Chandra required to schedule the next vulnerability scan of this network? * Immediately * Within one month * Before the start of next month * Before the end of the quarter following the upgrade

Answer 94

**Immediately** PCI DSS requires that networks be scanned quarterly or after any “significant change in the network.” A firewall upgrade definitely qualifies as a significant network change, and Chanda should schedule a vulnerability scan immediately to maintain PCI DSS compliance.

Question 95

152- Nick is configuring vulnerability scans for his network using a third‐party vulnerability scanning service. He is attempting to scan a web server that he knows exposes a CIFS file share and contains several significant vulnerabilities. However, the scan results only show ports 80 and 443 as open. What is the most likely cause of these scan results? * The CIFS file share is running on port 443. * A firewall configuration is preventing the scan from succeeding. * The scanner configuration is preventing the scan from succeeding. * The CIFS file share is running on port 80.

Answer 95

**A firewall configuration is preventing the scan from succeeding.** The most likely issue here is that there is a network firewall between the server and the third‐party scanning service. This firewall is blocking inbound connections to the web server and preventing the external scan from succeeding. CIFS generally runs on port 445, not port 80 or 443. Those ports are commonly associated with web services. The scanner is not likely misconfigured because it is successfully detecting other ports on the server. Nick should either alter the firewall rules to allow the scan to succeed or, preferably, place a scanner on a network in closer proximity to the web server.

Question 96

153- Thomas learned this morning of a critical security flaw that affects a major service used by his organization and requires immediate patching. This flaw was the subject of news reports and is being actively exploited. Thomas has a patch and informed stakeholders of the issue and received permission to apply the patch during business hours. How should he handle the change management process? * Thomas should apply the patch and then follow up with an emergency change request after work is complete. * Thomas should initiate a standard change request but apply the patch before waiting for approval. * Thomas should work through the standard change approval process and wait until it is complete to apply the patch. * Thomas should file an emergency change request and wait until it is approved to apply the patch.

Answer 96

**Thomas should apply the patch and then follow up with an emergency change request after work is complete.** Change management processes should always include an emergency change procedure. This procedure should allow applying emergency security patches without working through the standard change process. Thomas has already secured stakeholder approval on an informal basis, so he should proceed with the patch and then file a change request after the work is complete. Taking the time to file the change request before completing the work would expose the organization to a critical security flaw during the time required to complete the paperwork.

Question 97

156- Brian is configuring a vulnerability scan of all servers in his organization’s datacenter. He is configuring the scan to detect only the highest‐severity vulnerabilities. He would like to empower system administrators to correct issues on their servers but also have some insight into the status of those remediations. Which approach would best serve Brian’s interests? * Give the administrators access to view the scans in the vulnerability scanning system. * Send email alerts to administrators when the scans detect a new vulnerability on their servers. * Configure the vulnerability scanner to open a trouble ticket when they detect a new vulnerability on a server. * Configure the scanner to send reports to Brian who can notify administrators and track them in a spreadsheet.

Answer 97

**Configure the scanner to send reports to Brian who can notify administrators and track them in a spreadsheet.** The best path for Brian to follow would be to leverage the organization’s existing trouble ticket system. Administrators likely already use this system on a regular basis, and it can handle reporting and escalation of issues. Brian might want to give administrators access to the scanner and/or have emailed reports sent automatically as well, but those will not provide the tracking that he desires.

Question 98

158- Ben's manager recently assigned him to begin the remediation work on the most vulnerable server in his organization. A portion of the scan report appears here. What remediation action should Ben take first? (look up diagram in the book) * Install patches for Adobe Flash. * Install patches for Firefox. * Run Windows Update. * Remove obsolete software.

Answer 98

**Run Windows Update.** Ben is facing a difficult challenge and should likely perform all of the actions described in this question. However, the best starting point would be to run Windows Update to install operating system patches. Many of the critical vulnerabilities relate to missing Windows patches. The other actions may also resolve critical issues, but they all involve software that a user must run on the server before they can be exploited. This makes them slightly lower priorities than the Windows flaws that may be remotely exploitable with no user action.

Question 99

159- Zhang Wei completed a vulnerability scan of his organization’s virtualization platform from an external host and discovered the vulnerability shown here. How should he react? (look up diagram in book) This is a critical issue that requires immediate adjustment of firewall rules. This issue has a very low severity and does not require remediation. This issue should be corrected as time permits. This is a critical issue, and Zhang Wei should shut down the platform until it is corrected.

Answer 99

**This is a critical issue that requires immediate adjustment of firewall rules.** Although the vulnerability scan report does indicate that this is a low‐severity vulnerability, Zhang Wei must take this information in context. The management interface of a virtualization platform should never be exposed to external hosts, and it also should not use unencrypted credentials. In that context, this is a critical vulnerability that could allow an attacker to take control of a large portion of the computing environment. He should work with security and network engineers to block this activity at the firewall as soon as possible. Shutting down the virtualization platform is not a good alternative because it would be extremely disruptive, and the firewall adjustment is equally effective from a security point of view.

Question 100

162- Dave is running a vulnerability scan of a client’s network for the first time. The client has never run such a scan and expects to find many results. What security control is likely to remediate the largest portion of the vulnerabilities discovered in Dave’s scan? * Input validation * Patching * Intrusion prevention systems * Encryption

Answer 100

**Patching** Although all the solutions listed may remediate some of the vulnerabilities discovered by Dave’s scan, the vast majority of issues in an unmaintained network result from missing security updates. Applying patches will likely resolve quite a few vulnerabilities, if not the majority of them.

Question 101

165- Ling recently completed the security analysis of a web browser deployed on systems in her organization and discovered that it is susceptible to a zero‐day integer overflow attack. Who is in the best position to remediate this vulnerability in a manner that allows continued use of the browser? * Ling * The browser developer * The network administrator * The domain administrator

Answer 101

**The browser developer** Ling or the domain administrator could remove the software from the system, but this would not allow continued use of the browser. The network administrator could theoretically block all external web browsing, but this is not a practical solution. The browser developer is the only one in a good situation to correct an overflow error because it is a flaw in the code of the web browser.

Question 102

169- Mary is trying to determine what systems in her organization should be subject to vulnerability scanning. She would like to base this decision on the criticality of the system to business operations. Where should Mary turn to best find this information? * The CEO * System names * IP addresses * Asset inventory

Answer 102

**Asset inventory** Mary should consult the organization’s asset inventory. If properly constructed and maintained, this inventory should contain information about asset criticality. The CEO may know some of this information, but it is unlikely that they would have all the necessary information or the time to review it. System names and IP addresses may contain some hints to asset criticality but would not be as good a source as an asset inventory that clearly identifies criticality.

Question 103

171- Kamea is designing a vulnerability management system for her organization. Her highest priority is conserving network bandwidth. She does not have the ability to alter the configuration or applications installed on target systems. What solution would work best in Kamea’s environment to provide vulnerability reports? * Agent‐based scanning * Server‐based scanning * Passive network monitoring * Port scanning

Answer 103

**Passive network monitoring** Passive network monitoring meets Kamea’s requirements to minimize network bandwidth consumption while not requiring the installation of an agent. Kamea cannot use agent‐based scanning because it requires application installation. She should not use server‐based scanning because it consumes bandwidth. Port scanning does not provide vulnerability reports.

Question 104

173- Laura received a vendor security bulletin that describes a zero‐day vulnerability in her organization’s main database server. This server is on a private network but is used by publicly accessible web applications. The vulnerability allows the decryption of administrative connections to the server. What reasonable action can Laura take to address this issue as quickly as possible? * Apply a vendor patch that resolves the issue. * Disable all administrative access to the database server. * Require VPN access for remote connections to the database server. * Verify that the web applications use strong encryption.

Answer 104

**Require VPN access for remote connections to the database server.** The issue raised by this vulnerability is the possibility of eavesdropping on administrative connections to the database server. Requiring the use of a VPN would add strong encryption to this connection and negate the effect of the vulnerability. A patch is not an option because this is a zero‐day vulnerability, meaning that a patch is not yet available. Disabling administrative access to the database server would be unnecessarily disruptive to the business. The web server’s encryption level is irrelevant to the issue as it would affect connections to the web server, not the database server.

Question 105

177- Kylie reviewed the vulnerability scan report for a web server and found that it has multiple SQL injection and cross‐site scripting vulnerabilities. What would be the least difficult way for Kylie to address these issues? * Install a web application firewall. * Recode the web application to include input validation. * Apply security patches to the server operating system. * Apply security patches to the web server service.

Answer 105

**Install a web application firewall.** Applying patches to the server will not correct SQL injection or cross‐site scripting flaws, since these reside within the web applications themselves. Kylie could correct the root cause by recoding the web applications to use input validation, but this is the more difficult path. A web application firewall would provide immediate protection with lower effort.

Question 106

178- Karen ran a vulnerability scan of a web server used on her organization’s internal network. She received the report shown here. What circumstances would lead Karen to dismiss this vulnerability as a false positive? (look up diagram in book) * The server is running SSL v2. * The server is running SSL v3. * The server is for internal use only. * The server does not contain sensitive information.

Answer 106

**The server is for internal use only.** This error indicates that the vulnerability scanner was unable to verify the signature on the digital certificate used by the web server. If the organization is using a self‐signed digital certificate for this internal application, this would be an expected result.

Question 107

179- Which one of the following vulnerabilities is the most difficult to confirm with an external vulnerability scan? * Cross‐site scripting * Cross‐site request forgery * Blind SQL injection * Unpatched web server

Answer 107

**Blind SQL injection** Cross‐site scripting and cross‐site request forgery vulnerabilities are normally easy to detect with vulnerability scans because the scanner can obtain visual confirmation of a successful attack. Unpatched web servers are often identified by using publicly accessible banner information. Although scanners can often detect many types of SQL injection vulnerabilities, it is often difficult to confirm blind SQL injection vulnerabilities because they do not return results to the attacker but rely on the silent (blind) execution of code.

Question 108

180- Holly ran a scan of a server in her datacenter, and the most serious result was the vulnerability shown here. What action is most commonly taken to remediate this vulnerability? (look up diagram in book) * Remove the file from the server. * Edit the file to limit information disclosure. * Password protect the file. * Lmit file access to a specific IP range.

Answer 108

**Remove the file from the server.** The phpinfo file is a testing file often used by web developers during the initial configuration of a server. Although any of the solutions provided here may remediate this vulnerability, the most common course of action is to simply remove this file before the server is moved into production or made publicly accessible.

Question 109

183- Sharon is designing a new vulnerability scanning system for her organization. She must scan a network that contains hundreds of unmanaged hosts. Which of the following techniques would be most effective at detecting system configuration issues in her environment? * Agent‐based scanning * Credentialed scanning * Server‐based scanning * Passive network monitoring

Answer 109

**Server‐based scanning** It would be difficult for Sharon to use agent‐based or credentialed scanning in an unmanaged environment because she would have to obtain account credentials for each scanned system. Of the remaining two technologies, server‐based scanning is more effective at detecting configuration issues than passive network monitoring.

Question 110

185- Arlene ran a vulnerability scan of a VPN server used by contractors and employees to gain access to her organization’s network. An external scan of the server found the vulnerability shown here. (Look up diagram in book) What is the most likely result of failing to correct this vulnerability? * All users will be able to access the site. * All users will be able to access the site, but some may see an error message. * Some users will be unable to access the site. * All users will be unable to access the site.

Answer 110

**All users will be able to access the site, but some may see an error message.** This vulnerability should not prevent users from accessing the site, but it will cause their browsers to display a warning that the site is not secure.

Question 111

186- Arlene ran a vulnerability scan of a VPN server used by contractors and employees to gain access to her organization’s network. An external scan of the server found the vulnerability shown here. (Look up diagram in book) How can Arlene correct this vulnerability? * Reconfigure the VPN server to only use secure hash functions. * Request a new certificate. * Change the domain name of the server. * Implement an intrusion prevention system.

Answer 111

**Request a new certificate.** This error is a vulnerability in the certificate itself and may be corrected only by requesting a new certificate from the certificate authority (CA) that uses a secure hash algorithm in the certificate signature.

Question 112

192- Sara’s organization has a well‐managed test environment. What is the most likely issue that Sara will face when attempting to evaluate the impact of a vulnerability remediation by first deploying it in the test environment? * Test systems are not available for all production systems. * Production systems require a different type of patch than test systems. * Significant configuration differences exist between test and production systems. * Test systems are running different operating systems than production systems.

Answer 112

**Test systems are not available for all production systems.** In a well‐managed test environment, the test systems should be configured in a near‐identical manner to production systems. They should be running the same operating systems and require the same patches. However, in almost every organization, there are systems running in production that do not have mirror deployments in test environments because of cost, legacy system issues, and other reasons.

Question 113

194- Which one of the following types of data is subject to regulations in the United States that specify the minimum frequency of vulnerability scanning? * Driver’s license numbers * Insurance records * Credit card data * Medical records

Answer 113

**Credit card data** Credit card information is subject to the Payment Card Industry Data Security Standard (PCI DSS), which contains specific provisions that dictate the frequency of vulnerability scanning. Although the other data types mentioned in the question are regulated, none of those regulations contains specific provisions that identify a required vulnerability scanning frequency.

Question 114

195- Chang is responsible for managing his organization’s vulnerability scanning program. He is experiencing issues with scans aborting because the previous day’s scans are still running when the scanner attempts to start the current day’s scans. Which one of the following solutions is least likely to resolve Chang’s issue? * Add a new scanner. * Reduce the scope of the scans. * Reduce the sensitivity of the scans. * Reduce the frequency of the scans.

Answer 114

**Reduce the sensitivity of the scans.** Chang could resolve this issue by adding additional scanners to balance the load, reducing the frequency of scans or reducing the scope (number of systems) of the scan. Changing the sensitivity level would not likely have a significant impact on the scan time.

Question 115

206- Mia would like to ensure that her organization’s cybersecurity team reviews the architecture of a new ERP application that is under development. During which SDLC phase should Mia expect the security architecture to be completed? * Analysis and Requirements Definition * Design * Development * Testing and Integration

Answer 115

**Design** Security artifacts created during the Design phase include security architecture documentation and data flow diagrams.

Question 116

207- Which one of the following security activities is not normally a component of the Operations and Maintenance phase of the SDLC? * Vulnerability scans * Disposition * Patching * Regression testing

Answer 116

**Disposition** Disposition is a separate SDLC phase that is designed to ensure that data is properly purged at the end of an application life cycle. Operations and maintenance activities include ongoing vulnerability scans, patching, and regression testing after upgrades.

Question 117

211- Which one of the following characters would not signal a potential security issue during the validation of user input to a web application? * < * ' * > * $

Answer 117

**$** The $ character does not necessarily represent a security issue. The greater than/less than brackets (<>) are used to enclose HTML tags and require further inspection to determine whether they are part of a cross‐site scripting attack. The single quotation mark (') could be used as part of a SQL injection attack.

Question 118

216- Claire knows that a web application that her organization needs to have in production has vulnerabilities due to a recent scan using a web application security scanner. What is her best protection option if she knows that the vulnerability is a known SQL injection flaw? * A firewall * An IDS * A WAF * DLP

Answer 118

**A WAF** A web application firewall (WAF) can often be used to address the specific SQL injection attack. Claire can either write a rule based on the SQL injection attack or use a broader SQL injection prevention ruleset. An IDS would only detect the attack and would not stop it, whereas data loss prevention (DLP) tools might help if data was being stolen but won’t stop SQL injection. Some firewalls may have WAF functionality built in, but here the best option is the dedicated web application firewall.

Question 119

217- Donna has been assigned as the security lead for a DevSecOps team building a new web application. As part of the effort, she has to oversee the security practices that the team will use to protect the application. Use your knowledge of secure coding practices to help Donna guide her team through this process. A member of Donna’s team recommends building a blocklist to avoid dangerous characters like ' and