Vulnerability Management

Vulnerability scanning: (Select all that apply)

• Identifies lack of security controls

• Identifies common misconfigurations

• Passively tests security controls

Which of the answers listed below refer to the characteristic features of static code analysis? 

• Involves examining the code without executing it

• Often used early in the development process

• Examines code structure, syntax, and semantics to detect issues like syntax errors, coding standards violations, security vulnerabilities, and bugs

 Which of the following statements describe the features of dynamic code analysis?

• Typically used later in the software development lifecycle

• Analyzes runtime properties like memory usage, performance, and error handling to identify issues such as memory leaks, performance bottlenecks, and runtime errors

• Involves executing the code and analyzing its behavior at runtime

Which of the terms listed below refers to tracking and managing software application components, such as third-party libraries and other dependencies?

 Package monitoring

Which of the following terms refers to threat intelligence gathered from publicly available sources?

OSINT

Which of the terms listed below refers to a US government initiative for real-time sharing of cyber threat indicators?

Automated Indicator Sharing (AIS)

 What is STIX?

Common language for describing cyber threat information

A dedicated transport mechanism for cyber threat information is called:

TAXII

Which of the following provides insights into the methods and tools used by cybercriminals to carry out attacks?

Tactics, Techniques, and Procedure (TTP)

Penetration testing: (Select all that apply)

• Bypasses security controls

• Actively tests security controls

• Exploits vulnerabilities

A responsible disclosure program is a formal process established by an organization to encourage security researchers and ethical hackers to report vulnerabilities they discover in the organization's systems or software. A bug bounty program is a specific type of responsible disclosure program that offers financial rewards to security researchers for reporting valid vulnerabilities.

True

An antivirus software identifying non-malicious file as a virus due to faulty virus signature file is an example of:

False positive error

Which of the answers listed below refers to a situation where no alarm is raised when an attack has taken place?

False negative

A measure of the likelihood that a security system will incorrectly reject an access attempt by an authorized user is referred to as:

False Rejection Rate (FRR)

Which of the following terms refers to a framework and knowledge base that provides understanding of TTPs used during cyberattacks?

ATT&CK

Which of the answers listed below refers to an industry standard for assessing and scoring the severity of computer system security vulnerabilities?

CVSS

Which of the following refers to a system that identifies, defines, and catalogs publicly known cybersecurity vulnerabilities?

CVE

What is Exposure Factor (EF) in vulnerability analysis?

The degree of loss that a realized threat would have on a specific asset

Which of the statements listed below does not refer to a vulnerability response and remediation technique?

• Applying updates or fixes provided by software vendors to address the vulnerability (patching)

• Ensuring financial recovery from the costs associated with a successful cyberattack (insurance)

• Dividing a network into smaller, isolated zones to limit the potential impact of a vulnerability (segmentation)

• Mitigating the risk associated with a vulnerability that cannot be immediately patched by implementing alternative security measures (compensating controls)

• Delaying or forgoing a patch for a specific system, e.g., when applying a patch may not be feasible due to compatibility issues or potential disruptions to critical systems (exceptions and exemptions)

All of the above answers are examples of vulnerability response and remediation techniques