CND Threat Assessment & Vulnerability Management 3

Question 1

Which threat modeling methodology focuses on identifying threats by categorizing them as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Accepted Answer

STRIDE

Answer

STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six types to help identify security weaknesses in systems.

Question 2

A security team wants to assess threats by focusing on business impact and organizational risk tolerance rather than purely technical vulnerabilities. Which methodology is most appropriate?

Accepted Answer

OCTAVE

Answer

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a risk-based methodology that aligns threat assessment with organizational mission and business objectives.

Question 3

In vulnerability management, what is a 'false positive'?

Accepted Answer

A scanner report indicating a vulnerability exists when it actually does not

Answer

A false positive occurs when a vulnerability scanner incorrectly flags a condition as a vulnerability when no actual vulnerability exists, wasting remediation effort.

Question 4

Which type of vulnerability assessment involves providing the tester with full knowledge of the network architecture, credentials, and source code?

Accepted Answer

White-box assessment

Answer

A white-box assessment gives the tester complete knowledge of the target environment, enabling thorough and efficient testing with access to internal documentation and credentials.

Question 5

What is the purpose of a threat intelligence platform (TIP) in a network defender's toolkit?

Accepted Answer

To aggregate, correlate, and analyze threat data from multiple sources to support proactive defense

Answer

A TIP centralizes threat intelligence from various feeds and sources, allowing security teams to correlate data and make informed decisions about defenses and incident response.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Threat Assessment & Vulnerability Management 3