Examkin

Question

Difficulty: MediumVulnerability Scanning and Assessment

A security analyst receives a high-severity report from an unauthenticated network-based vulnerability scan indicating that several internal Linux servers are susceptible to a critical remote code execution vulnerability in OpenSSL. However, local patch management logs confirm that all vendor-issued security updates were applied earlier that week. Which of the following is the most appropriate action for the analyst to take to verify whether the servers are genuinely vulnerable?

  1. Perform a credentialed scan on the servers to inspect installed package versions directly.Answer
  2. B
    Implement an inline network firewall rule blocking inbound port 443 traffic to mitigate potential exploitation.
  3. C
    Deploy a honeypot within the server subnet to inline-block incoming exploit payloads.
  4. D
    Modify the SIEM correlation rules to suppress high-severity alerts related to OpenSSL vulnerabilities.

Answer

Perform a credentialed scan on the servers to inspect installed package versions directly.
Unauthenticated network scans rely primarily on banner grabbing, which inspects remote service version headers. Many Linux distributions backport security fixes into existing package versions without incrementing the main software version banner, leading unauthenticated scanners to report false positives. Conducting a credentialed scan grants host-level access to query the package manager directly, accurately verifying whether the patch has been applied.

Step-by-Step Solution

1
Analyze the cause of discrepancy between the scan report and patch management records.
Unauthenticated network scans rely on service banner grabbing, which often produces false positives when operating system vendors backport security fixes without changing the primary software version banner.
Identifying why unauthenticated scans misidentify vulnerabilities is necessary to choose the correct verification method.
2
Determine the appropriate scanning methodology to accurately verify patch status.
Credentialed (authenticated) scanning enables the vulnerability scanner to log into the target operating system and audit local package databases or software registries directly.
Host-level verification provides definitive evidence of installed security patches without relying on external network banners.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning and False Positive Resolution
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic