Examkin

Soru

Zorluk: OrtaVulnerability Scanning and Assessment

A security analyst conducts a scheduled vulnerability assessment against an internal database cluster. The network scanner reports multiple critical operating system patch vulnerabilities on the target servers based on exposed service banners. Upon further inspection, the system administrator notes that the enterprise patch management policy uses Linux vendor backporting, which patches vulnerabilities without incrementing the reported software release version string. Which of the following scanning approaches should the analyst implement to obtain accurate patch compliance results and eliminate these false positives?

  1. Execute a credentialed scan using local administrative credentials or a host-based agent.Cevap
  2. B
    Deploy an inline web application firewall to strip service banner response headers before they reach the scanner.
  3. C
    Configure the network vulnerability scanner to execute active SQL injection exploitation scripts against open database ports.
  4. D
    Reclassify the active vulnerability scanner from a detective tool to a compensating preventive control within the risk framework.

Cevap

Execute a credentialed scan using local administrative credentials or a host-based agent.
The correct answer advocates for executing a credentialed scan using local credentials or a host-based agent. Non-credentialed vulnerability scans inspect services remotely by banner grabbing, which reports generic version numbers. Linux enterprise vendors regularly backport security patches into existing version builds without incrementing the primary release version. Credentialed scans log into the target host to query local package manager databases and patch files directly, accurately verifying patch status and resolving banner-based false positives.

Adım Adım Çözüm

1
Analyze the cause of the false positive scanner report.
Uncredentialed network scans rely on banner grabbing (version strings exposed over ports), which fails to recognize backported patches that maintain original version strings.
Linux distribution vendors frequently backport security fixes into older package version strings to preserve application stability.
2
Evaluate scanning methodologies to access internal host patch inventories.
Credentialed scanning (or agent-based scanning) authenticates directly to the target system host.
Authenticating allows the scanner to query local package management databases (e.g., rpm or dpkg) and verify specific patch build numbers directly.
3
Select the optimal scanning approach to resolve banner-based false positives.
Credentialed host scanning provides precise visibility into internal system state and eliminates false positive patch alerts caused by vendor backporting.
This direct inspection ensures audit compliance while reducing unnecessary remediation overhead.

Anahtar Kavram

Credentialed vs. Uncredentialed Vulnerability Scanning and Banner Grabbing Limitation
Bu soruyu puanla

Konular

Vulnerability Scanning and Assessment

Bu konudan daha fazla soru