NSE Threat Analysis & Vulnerability Management 3 — Questions and Answers
Question 1: When prioritizing vulnerability remediation, which factor most directly determines the urgency of patching?
- The age of the affected system
- CVSS score combined with asset criticality and exploitability in the wild (Correct answer)
- Number of open ports on the system
- The vendor's patch release schedule
Correct answer: CVSS score combined with asset criticality and exploitability in the wild
Effective prioritization combines CVSS severity with the asset's business criticality and whether the vulnerability is actively being exploited in the wild.
Question 2: Which component of the Cyber Kill Chain represents the attacker establishing a foothold after successful exploitation?
- Weaponization
- Delivery
- Installation (Correct answer)
- Actions on Objectives
Correct answer: Installation
The Installation phase occurs when the attacker installs a backdoor or remote access tool to maintain persistence after exploitation.
Question 3: A FortiSIEM administrator wants to detect lateral movement. Which log source is most valuable for this purpose?
- Web proxy logs
- Windows Security Event Logs with logon events (4624, 4648) (Correct answer)
- DHCP lease logs
- DNS recursive query logs
Correct answer: Windows Security Event Logs with logon events (4624, 4648)
Windows Security Event IDs 4624 (successful logon) and 4648 (explicit credential logon) reveal authentication patterns characteristic of lateral movement.
Question 4: What distinguishes a vulnerability assessment from a penetration test?
- Vulnerability assessments actively exploit weaknesses; pen tests only report them
- Vulnerability assessments identify and report weaknesses; pen tests attempt to exploit them to demonstrate impact (Correct answer)
- Penetration tests use automated scanners; vulnerability assessments are manual only
- They are identical in methodology and scope
Correct answer: Vulnerability assessments identify and report weaknesses; pen tests attempt to exploit them to demonstrate impact
A vulnerability assessment enumerates and ranks weaknesses without exploitation, while a penetration test actively exploits vulnerabilities to demonstrate real-world impact.
Question 5: In threat analysis, what is 'threat hunting'?
- Automated blocking of known malicious IPs
- Proactive human-led search for threats that have evaded automated detection (Correct answer)
- Reviewing vendor threat intelligence feeds passively
- Setting up honeypots to attract attackers
Correct answer: Proactive human-led search for threats that have evaded automated detection
Threat hunting is a proactive, human-driven process where analysts search for hidden threats that have bypassed existing security controls.
Question 6: Which NSE-level tool provides automated threat correlation and incident management across Fortinet fabric components?
- FortiProxy
- FortiSIEM (Correct answer)
- FortiSwitch
- FortiToken
Correct answer: FortiSIEM
FortiSIEM collects logs from Fortinet and third-party devices, correlates events using rules and ML, and manages security incidents across the Security Fabric.
Question 7: An attacker registers a domain visually similar to a target company's domain to deceive employees. This technique is called:
- DNS poisoning
- Typosquatting (Correct answer)
- BGP hijacking
- ARP spoofing
Correct answer: Typosquatting
Typosquatting involves registering domains with slight misspellings or visual similarity to legitimate domains to trick users into visiting malicious sites.
NSE Threat Analysis & Vulnerability Management 3
When prioritizing vulnerability remediation, which factor most directly determines the urgency of patching?