CySA Module 3 - Vulnerability Management

Kendra has a very limited budget but has three critical servers that she needs to secure against data breaches within her company's infrastructure. She knows that she won't be able to protect the entire network, but she has started searching for a solution to secure the most critical assets. Which of the following options would she most likely choose?

• UTM appliance

• NIPS

• Proxy server

• HIPS

Talia has just been hired as the first security employee at an organization. Until this point, security has been everyone's responsibility, but she knows that the IT staff have different skill sets and may not be aware of certain weaknesses within various platforms. Which of the following tools might Talia use to help her determine the state of the existing infrastructure?

• NIDS

• Vulnerability scanner

• OS fingerprinting

• Syslog

Cheyenne is concerned about a recent news story that global data breaches are on the rise. She believes that she has installed the latest detection software on all of the servers she is responsible for, but she knows that security requires a layered approach. Which of the following might she also decide to implement?

• Proxy server

• Spam filter

• HIPS

• NIPS

A network intrusion prevention system provides protection from data breaches at the network level. A NIPS looks at traffic before it gets to the hosts rather than examining it once the data arrives.

• Incorrect

• Incorrect

• Incorrect

• Correct

A group of doctor's offices have decided to merge into one organization. As part of the migration, the cybersecurity team is responsible for determining how systems from the different offices will be able to share information with each other until they can be formally combined into a single system. Which of the following does the cybersecurity team need to keep in mind throughout the merger as they perform the necessary tasks of combining systems that are specific to the medical field?

• FISMA

• PCI DSS

• MOMA

• HIPAA

Kiah, a cybersecurity analyst for the government, is setting up a new Linux server and needs to configure the data classification labels to be used for the new application. Which of the following are valid labels for U.S. government systems?

• Public, secret, top secret

• Sensitive but unclassified, classified, secret

• Confidential, secret, top secret

• Classified, secret, top secret

Ramon has been hired as a consultant for a large corporation to validate its existing security controls. Which of the following would most likely be one of the first pieces of data he requests?

• Risk matrix

• Asset inventory

• Service-level agreement

• Operational-level agreement

Ramon should first ask for an asset inventory. Which of the following statements is correct?

• An asset inventory will allow Ramon to ensure that all of the systems within the company's infrastructure have been sufficiently secured.

• A service-level agreement defines the amount of time that a service should be available to users.

• An operational-level agreement defines how an application or service will be supported.

Nadia, a cybersecurity analyst, has installed a vulnerability scanning application called Nessus that uses modular updates she can download and install as needed. Which of the following terms may be used to describe these updates?

• Plug-ins

• Patches

• Service packs

• Updates

Loide is a cybersecurity analyst and is looking for a vulnerability scanner that will pull updates from a web-based feed so that it constantly has the latest information about new vulnerabilities as they're discovered. Which of the following might be a good source of data for the scanner?

• NVLM

• OSCVD

• NVCDB

• NVD