Deck 5: Scanning for Vulnerabilities

Question 1

A vulnerability scan is a single event using a manual process that is too often performed only to comply with regulatory requirements.

Answer 1

False

Question 2

Which of the following describes a collection of requirements specific to a system or procedure that must be met by everyone?

A) Policy
B) Standard
C) Framework
D) Guideline

Answer 2

Standard

Question 3

Which of the following describes a vulnerability scan?

A) It identifies deep vulnerabilities.
B) It uses external third parties to conduct the scan.
C) It uses a primarily automated process.
D) It aims to gain unauthorized access.

Answer 3

It uses a primarily automated process.

Question 4

An organization's tolerance for exposure to a vulnerability is called its _____________.

Question 5

Name a product that is a well-known vulnerability scanner.

Question 6

Which of the following is a full-featured vulnerability scanner that includes over 50,000 vulnerability tests?

A) Metasploit
B) Scantron
C) OpenVAS
D) GNU GPL

Question 7

What are module updates that can be downloaded and installed as needed?

Question 8

Which of the following is not a vulnerability feed?

A) Department of Defense Database of Vulnerabilities (DoD-DV)
B) NIST National Vulnerability Database (NVD)
C) Mitre Common Vulnerabilities and Exposures (CVE)
D) VulnDB

Question 9

When you are actively seeking information on the Internet, such as an answer to a question, are you using a "pull" method or a "push" method?

Question 10

Which of the following demonstrates a "convergence of will" between the parties so that they can work together, but is not generally considered a legally enforceable agreement?

A) Service level agreement
B) Memorandum of understanding
C) Interconnection security agreement
D) Non-disclosure agreement (NDA)