Examkin

Soru

Zorluk: OrtaVulnerability Scanning and Assessment

During an internal vulnerability assessment, an unauthenticated network scanner flags several Linux production web servers as high-risk due to an outdated Apache version disclosed in the HTTP response headers. The Linux system administrators state that security patches were backported by the distribution vendor, meaning the vulnerabilities were remediated despite the version string remaining unchanged. Which of the following actions is the most appropriate next step for the security analyst to accurately verify the true vulnerability status of these servers?

  1. Perform a credentialed vulnerability scan to inspect local package management metadata directly on the target hosts.Cevap
  2. B
    Deploy host-based firewall rules to block inbound HTTP traffic to the web server ports until the version banner is updated.
  3. C
    Reconfigure the SIEM correlation rules to automatically suppress SQL injection alerts originate from these web servers.
  4. D
    Reclassify the network vulnerability scanner as an inline preventive control to filter out invalid version responses.

Cevap

Perform a credentialed vulnerability scan to inspect local package management metadata directly on the target hosts.
Performing a credentialed scan allows the vulnerability scanner to authenticate to the Linux host and query the local package manager (e.g., rpm or dpkg). This directly inspects the installed package patch history and confirms backported security fixes that unauthenticated network banner scans cannot detect, accurately resolving false positives.

Adım Adım Çözüm

1
Analyze the cause of the potential false positive.
Unauthenticated (non-credentialed) scans rely on network banner grabbing, which reads software version strings exposed over the network. Linux vendors frequently backport security fixes without incrementing major version numbers, causing banner grabs to report false positives.
Understanding scanner limitations prevents unnecessary emergency patching or operational disruptions.
2
Select an assessment method capable of inspecting internal host package states.
A credentialed vulnerability scan logs into the target system using provided administrative credentials to check installed software package versions via the host operating system's package manager.
Host-level inspection provides precise diagnostic data that overrides external network banner assumptions.
3
Verify the true vulnerability status.
The credentialed scan confirms that the vendor backport patch is active, validating the false positive status of the initial unauthenticated scan.
This allows the security team to document the finding correctly without applying unnecessary network blocks.

Anahtar Kavram

Credentialed vs. Non-Credentialed Vulnerability Scanning (Backported Patches)
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Vulnerability Scanning and Assessment

Bu konudan daha fazla soru