CyberOps Chap23

In profiling a server, what defines what an application is allowed to do or run on a server?

• Software environment

• Service accounts

• Logged in users and accounts

• Listening ports

Which metric class in the CVSS Basic Metric Group identifies the impacts on confidentiality, integrity, and availability?

• Impact

• Exploitability

• Exploit Code Maturity

• Modified Base

When establishing a server profile for an organization, which element describes the type of service that an application is allowed to run on the server?

• Listening ports

• User Account

• Service accounts

• Software environment

What are the steps in the vulnerability management life cycle?

• detect, analyze, recover, respond

• identify, protect, detect, respond,recover

• plan, do, act, check

• discover, prioritize assets, assess, report, remediate, verify

Which security management function is concerned with the inventory and control of hardware and software configurations of systems?

• Risk Management

• Vulnerability Assessment

• Asset Management

• Configuration Managemenet

In addressing an identified risk, which strategy aims to decrease the risk by taking measures to reduce vulnerability?

• Risk Retention

• Risk Sharing

• Risk Avoidance

• Risk Reduction

Which step in the Vulnerability Management Life Cycle performs inventory of all assets across the network and identifies host details, including operating system and open services?

• Assess

• Remediate

• Discover

• Prioritize Asset

Which security management function is concerned with the implementation of systems that track the location and configuration of networked devices and software across an enterprise?

• Risk management

• Vulnerability management

• Asset management

• Configuration management

Which class of metric in the CVSS Base Metric Group defines the features of the exploit such as the vector, complexity, and user interaction required by the exploit?

• Impact

• Modified Base

• Exploit Code Maturity

• Exploitability

• Prioritize according to business risk and address vulnerabilities in order of risk.

• Remediate

• Verify

• Report

• Prioritize Assets