NSE Threat Analysis & Vulnerability Management 3

Question 1

When prioritizing vulnerability remediation, which factor most directly determines the urgency of patching?

Accepted Answer

CVSS score combined with asset criticality and exploitability in the wild

Answer

Effective prioritization combines CVSS severity with the asset's business criticality and whether the vulnerability is actively being exploited in the wild.

Question 2

Which component of the Cyber Kill Chain represents the attacker establishing a foothold after successful exploitation?

Accepted Answer

Installation

Answer

The Installation phase occurs when the attacker installs a backdoor or remote access tool to maintain persistence after exploitation.

Question 3

A FortiSIEM administrator wants to detect lateral movement. Which log source is most valuable for this purpose?

Accepted Answer

Windows Security Event Logs with logon events (4624, 4648)

Answer

Windows Security Event IDs 4624 (successful logon) and 4648 (explicit credential logon) reveal authentication patterns characteristic of lateral movement.

Question 4

What distinguishes a vulnerability assessment from a penetration test?

Accepted Answer

Vulnerability assessments identify and report weaknesses; pen tests attempt to exploit them to demonstrate impact

Answer

A vulnerability assessment enumerates and ranks weaknesses without exploitation, while a penetration test actively exploits vulnerabilities to demonstrate real-world impact.

Question 5

In threat analysis, what is 'threat hunting'?

Accepted Answer

Proactive human-led search for threats that have evaded automated detection

Answer

Threat hunting is a proactive, human-driven process where analysts search for hidden threats that have bypassed existing security controls.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE Threat Analysis & Vulnerability Management 3