Vulnerability Management Quiz Flashcards
Vulnerability scanning: (Select all that apply)
A) Identifies lack of security controls
B) Actively tests security controls
C) Identifies common misconfigurations
D) Exploits vulnerabilities
E) Passively tests security controls
A) Identifies lack of security controls
C) Identifies common misconfigurations
E) Passively tests security controls
Which of the answers listed below refer to the characteristic features of static code analysis? (Select 3 answers)
A) Involves examining the code without executing it
B) Often used early in the development process
C) Examines code structure, syntax, and semantics to detect issues like syntax errors, coding standards violations, security vulnerabilities, and bugs
D) Typically used later in the software development lifecycle
E) Involves executing the code and analyzing its behavior at runtime
F) Analyzes runtime properties like memory usage, performance, and error handling to identify issues such as memory leaks, performance bottlenecks, and runtime errors
A) Involves examining the code without executing it
B) Often used early in the development process
C) Examines code structure, syntax, and semantics to detect issues like syntax errors, coding standards violations, security vulnerabilities, and bugs
Which of the terms listed below refers to tracking and managing software application components, such as third-party libraries and other dependencies?
A) Version control
B) Package monitoring
C) Configuration enforcement
D) Application hardening
B) Package monitoring
Which of the following statements describe the features of dynamic code analysis? (Select 3 answers)
A) Typically used later in the software development lifecycle
B) Involves examining the code without executing it
C) Analyzes runtime properties like memory usage, performance, and error handling to identify issues such as memory leaks, performance bottlenecks, and runtime errors
D) Often used early in the development process
E) Examines code structure, syntax, and semantics to detect issues like syntax errors, coding standards violations, security vulnerabilities, and bugs
F) Involves executing the code and analyzing its behavior at runtime
A) Typically used later in the software development lifecycle
C) Analyzes runtime properties like memory usage, performance, and error handling to identify issues such as memory leaks, performance bottlenecks, and runtime errors
F) Involves executing the code and analyzing its behavior at runtime
Which of the following terms refers to threat intelligence gathered from publicly available sources?
A) IoC
B) OSINT
C) RFC
D) CVE/NVD
B) OSINT
Which of the terms listed below refers to a US government initiative for real-time sharing of cyber threat indicators?
A) AIS
B) STIX
C) TTP
D) CVSS
A) AIS
What is STIX?
A) A type of vulnerability database
B) Common language for describing cyber threat information
C) US government initiative for real-time sharing of cyber threat indicators
D) Transport mechanism for cyber threat information
B) Common language for describing cyber threat information
A dedicated transport mechanism for cyber threat information is called:
A) TCP/IP
B) TLS
C) TAXII
D) S/MIME
C) TAXII
Which of the following provides insights into the methods and tools used by cybercriminals to carry out attacks?
A) CVE
B) IoC
C) AIS
D) TTP
D) TTP
Which of the following statements does not apply to dark web?
A) Typically requires specialized software to access its contents
B) Forms a large part of the deep web
C) Not indexed by traditional search engines
D) Often associated with trading stolen data, malware, and cyber threats
B) Forms a large part of the deep web
Penetration testing: (Select all that apply)
A) Bypasses security controls
B) Only identifies lack of security controls
C) Actively tests security controls
D) Exploits vulnerabilities
E) Passively tests security controls
A) Bypasses security controls
C) Actively tests security controls
D) Exploits vulnerabilities
A responsible disclosure program is a formal process established by an organization to encourage security researchers and ethical hackers to report vulnerabilities they discover in the organization’s systems or software. A bug bounty program is a specific type of responsible disclosure program that offers financial rewards to security researchers for reporting valid vulnerabilities.
A) True
B) False
A) True
An antivirus software identifying non-malicious file as a virus due to faulty virus signature file is an example of:
A) Fault tolerance
B) False positive error
C) Quarantine feature
D) False negative error
B) False positive error
Which of the answers listed below refers to a situation where no alarm is raised when an attack has taken place?
A) False negative
B) True positive
C) False positive
D) True negative
A) False negative
A measure of the likelihood that a security system will incorrectly reject an access attempt by an authorized user is referred to as:
A) FAR
B) CER
C) CRC
D) FRR
D) FRR
