CND Threat Assessment & Vulnerability Management 3 — Questions and Answers
Question 1: Which threat modeling methodology focuses on identifying threats by categorizing them as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
- PASTA
- STRIDE (Correct answer)
- OCTAVE
- VAST
Correct answer: STRIDE
STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six types to help identify security weaknesses in systems.
Question 2: A security team wants to assess threats by focusing on business impact and organizational risk tolerance rather than purely technical vulnerabilities. Which methodology is most appropriate?
- STRIDE
- CVSS
- OCTAVE (Correct answer)
- Nessus scanning
Correct answer: OCTAVE
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a risk-based methodology that aligns threat assessment with organizational mission and business objectives.
Question 3: In vulnerability management, what is a 'false positive'?
- A vulnerability that has been confirmed but cannot be patched
- A scanner report indicating a vulnerability exists when it actually does not (Correct answer)
- A vulnerability that is exploited before a patch is available
- A patch that does not fully remediate the vulnerability
Correct answer: A scanner report indicating a vulnerability exists when it actually does not
A false positive occurs when a vulnerability scanner incorrectly flags a condition as a vulnerability when no actual vulnerability exists, wasting remediation effort.
Question 4: Which type of vulnerability assessment involves providing the tester with full knowledge of the network architecture, credentials, and source code?
- Black-box assessment
- Gray-box assessment
- White-box assessment (Correct answer)
- Red team assessment
Correct answer: White-box assessment
A white-box assessment gives the tester complete knowledge of the target environment, enabling thorough and efficient testing with access to internal documentation and credentials.
Question 5: What is the purpose of a threat intelligence platform (TIP) in a network defender's toolkit?
- To automatically patch vulnerabilities identified by scanners
- To aggregate, correlate, and analyze threat data from multiple sources to support proactive defense (Correct answer)
- To block all inbound traffic from known threat actors
- To generate compliance reports for auditors
Correct answer: To aggregate, correlate, and analyze threat data from multiple sources to support proactive defense
A TIP centralizes threat intelligence from various feeds and sources, allowing security teams to correlate data and make informed decisions about defenses and incident response.
Question 6: An organization discovers a zero-day vulnerability in a critical system with no vendor patch available. Which is the BEST immediate compensating control?
- Shut down the affected system permanently
- Apply network segmentation and enhanced monitoring around the vulnerable system (Correct answer)
- Wait for the vendor to release a patch before taking action
- Notify all users and ask them to avoid the system
Correct answer: Apply network segmentation and enhanced monitoring around the vulnerable system
When no patch is available, isolating the vulnerable system through network segmentation and increasing monitoring reduces risk while maintaining some operational capability.
Question 7: Which document formally authorizes a penetration testing team to conduct tests against an organization's systems?
- Vulnerability assessment report
- Rules of Engagement (RoE) (Correct answer)
- Statement of Work (SoW)
- Non-Disclosure Agreement (NDA)
Correct answer: Rules of Engagement (RoE)
The Rules of Engagement define the scope, timing, methods, and boundaries of a penetration test, providing legal authorization for the testing activities.
CND Threat Assessment & Vulnerability Management 3
Which threat modeling methodology focuses on identifying threats by categorizing them as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?