Examkin

Soru

Zorluk: ZorVulnerability Scanning and Assessment

A security engineer is refining the vulnerability assessment strategy for an enterprise data center hosting high-availability web applications and legacy backend databases. To ensure deep asset visibility while mitigating the risk of service disruption and unauthorized network impact, which of the following operational practices should the engineer implement? (Select TWO.)

  1. Schedule intrusive vulnerability scanning templates exclusively during pre-approved maintenance windows.Cevap
  2. Use credentialed access to audit local system configurations, installed software inventories, and missing patches.Cevap
  3. C
    Deploy network perimeter firewalls to automatically repair application-layer vulnerabilities identified by the scanner.
  4. D
    Classify the automated vulnerability scanner as a corrective control designed to remediate security weaknesses automatically.

Cevap

The security engineer should schedule intrusive vulnerability scan templates exclusively during pre-approved maintenance windows and use credentialed access to audit local configurations, installed software, and missing patches.
Scheduling intrusive scans during maintenance windows protects production availability from unexpected system crashes, while credentialed scanning provides precise internal configuration visibility with minimal network impact and reduced false positives.

Adım Adım Çözüm

1
Evaluate the operational impact of scan intensity levels on critical assets.
Recognize that intrusive scanning techniques can exhaust host resources or crash legacy services if executed during peak hours.
Intrusive scans actively probe weaknesses and must be confined to maintenance windows to safeguard service availability.
2
Determine the scanning methodology that maximizes accuracy while reducing network overhead.
Select authenticated (credentialed) scanning over unauthenticated network probing.
Credentialed scanning queries local system registries and patch databases directly, reducing false positives without saturating network bandwidth.
3
Differentiate detective scanning tools from preventive and corrective security controls.
Reject firewalls and scanners as automated patch remediation mechanisms.
Scanners are detective controls and firewalls are preventive traffic filters; application flaws require software updates or code refactoring.

Anahtar Kavram

Vulnerability Scanning Methodologies and Operational Controls
Bu soruyu puanla

Konular

Vulnerability Scanning and Assessment

Bu konudan daha fazla soru