Practice Exams:

View All

CompTIA CySA+ CS0-003 Vulnerability Scanning Methods And Concepts Practice Test

Objective 2.1 • 36 original questions

This CompTIA CySA+ CS0-003 practice test focuses on objective 2.1: vulnerability scanning methods and concepts. All questions are original ExamSnap scenarios aligned to the official CS0-003 objective set; they are not copied from live CompTIA exam content. Review every option explanation to understand why a choice fits or does not fit the scenario. For broader exam preparation, review the CompTIA CySA+ CS0-003 Exam Dumps page.

Instructions: Select the best answer unless the question explicitly says Select TWO or Select THREE. Review the explanation and option review after answering.

Question 1

A review at Wingtip Services finds a gap: the team cannot reliably identify live systems and exposed network services across an address range. Which option best closes that gap? The team wants the most defensible analyst action before expanding the investigation.

Active scanning
Network map scan
External scanning
ISO 27000-series alignment
Performance-aware scanning

Correct answer: B

Why: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. It directly fits this scenario because the requirement is to identify live systems and exposed network services across an address range.

Option review:

A: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

B: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. It directly fits this scenario because the requirement is to identify live systems and exposed network services across an address range.

C: External scans evaluate the internet-facing attack surface from outside the organization. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

D: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

E: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

Learning point: Use Network map scan when the key requirement is to identify live systems and exposed network services across an address range.

Question 2

a threat hunter at Woodgrove Bank is comparing several approaches. The deciding requirement is to classify discovered assets when inventory data is incomplete. Which option should be chosen? Select based on the scenario’s decisive constraint, not on which technology is newest.

Agentless scanning
Static analysis
Device fingerprinting
PCI DSS alignment
Performance-aware scanning

Correct answer: C

Why: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. It directly fits this scenario because the requirement is to classify discovered assets when inventory data is incomplete.

Option review:

A: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete.

B: Static analysis examines code or binaries without executing them. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete.

C: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. It directly fits this scenario because the requirement is to classify discovered assets when inventory data is incomplete.

D: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete.

E: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete.

Learning point: Use Device fingerprinting when the key requirement is to classify discovered assets when inventory data is incomplete.

Question 3

While supporting a regulated customer-data environment, a risk analyst is asked to avoid disrupting a critical system while still obtaining current vulnerability data. Which concept or tool is the clearest match? Assume the activity is authorized and must follow normal enterprise change control.

Device fingerprinting
PCI DSS alignment
Scan scheduling
Sensitivity and segmentation planning
ISO 27000-series alignment

Correct answer: C

Why: Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. It directly fits this scenario because the requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

Option review:

A: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

B: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

C: Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. It directly fits this scenario because the requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

D: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

E: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

Learning point: Use Scan scheduling when the key requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

Question 4

A new security procedure at Contoso Health must enable analysts to reduce the chance that assessment traffic degrades production performance. Which option is the BEST choice? Assume no additional product-specific features are available beyond the concepts listed.

Performance-aware scanning
PCI DSS alignment
Dynamic analysis
Regulatory scanning requirement
Agent-based scanning

Correct answer: A

Why: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. It directly fits this scenario because the requirement is to reduce the chance that assessment traffic degrades production performance.

Option review:

A: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. It directly fits this scenario because the requirement is to reduce the chance that assessment traffic degrades production performance.

B: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

C: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

D: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

E: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

Learning point: Use Performance-aware scanning when the key requirement is to reduce the chance that assessment traffic degrades production performance.

Question 5

The primary objective for Blue Yonder Airlines is to adapt scanning for highly sensitive or isolated network segments. Which selection best satisfies that objective in an airline operations network? The organization wants a vendor-neutral approach that can be explained during audit review.

Reverse engineering
Internal scanning
Non-credentialed scanning
External scanning
Sensitivity and segmentation planning

Correct answer: E

Why: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. It directly fits this scenario because the requirement is to adapt scanning for highly sensitive or isolated network segments.

Option review:

A: Reverse engineering analyzes binaries or behavior to understand implementation, logic, or vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

B: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

C: Unauthenticated scans approximate what an external attacker can observe without valid credentials. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

D: External scans evaluate the internet-facing attack surface from outside the organization. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

E: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. It directly fits this scenario because the requirement is to adapt scanning for highly sensitive or isolated network segments.

Learning point: Use Sensitivity and segmentation planning when the key requirement is to adapt scanning for highly sensitive or isolated network segments.

Question 6

At Lucerne Publishing, a detection engineer needs to schedule and document scans to satisfy an external compliance obligation. Which option is the BEST fit for a remote-work environment? Base the decision on the primary security requirement, not on implementation convenience.

Regulatory scanning requirement
OT/ICS/SCADA scanning precautions
Credentialed scanning
Agentless scanning
Security baseline scanning

Correct answer: A

Why: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. It directly fits this scenario because the requirement is to schedule and document scans to satisfy an external compliance obligation.

Option review:

A: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. It directly fits this scenario because the requirement is to schedule and document scans to satisfy an external compliance obligation.

B: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

C: Authenticated scans use valid credentials to inspect configuration, patch state, packages, and local settings with greater depth. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

D: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

E: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

Learning point: Use Regulatory scanning requirement when the key requirement is to schedule and document scans to satisfy an external compliance obligation.

Question 7

During an investigation at Fabrikam Finance, the immediate requirement is to measure vulnerabilities reachable from inside the enterprise network. What should a vulnerability analyst select? The environment follows least privilege and preserves evidence where incident handling is involved.

Static analysis
Internal scanning
External scanning
Network map scan
OT/ICS/SCADA scanning precautions

Correct answer: B

Why: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. It directly fits this scenario because the requirement is to measure vulnerabilities reachable from inside the enterprise network.

Option review:

A: Static analysis examines code or binaries without executing them. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

B: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. It directly fits this scenario because the requirement is to measure vulnerabilities reachable from inside the enterprise network.

C: External scans evaluate the internet-facing attack surface from outside the organization. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

D: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

E: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

Learning point: Use Internal scanning when the key requirement is to measure vulnerabilities reachable from inside the enterprise network.

Question 8

City Power Utilities is updating its security operations standard for a segmented industrial environment. Which option most directly helps the team identify weaknesses visible to an unauthenticated internet-based attacker? Use the choice that most directly addresses the stated evidence rather than a broader control.

External scanning
Network map scan
OWASP application guidance
Sensitivity and segmentation planning
Security baseline scanning

Correct answer: A

Why: External scans evaluate the internet-facing attack surface from outside the organization. It directly fits this scenario because the requirement is to identify weaknesses visible to an unauthenticated internet-based attacker.

Option review:

A: External scans evaluate the internet-facing attack surface from outside the organization. It directly fits this scenario because the requirement is to identify weaknesses visible to an unauthenticated internet-based attacker.

B: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

C: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

D: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

E: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

Learning point: Use External scanning when the key requirement is to identify weaknesses visible to an unauthenticated internet-based attacker.

Question 9

A ticket at A. Datum Logistics asks a security consultant to assess remote endpoints that are not reliably reachable by the scanner. Which choice addresses the requirement most directly? The team wants the most defensible analyst action before expanding the investigation.

Sensitivity and segmentation planning
Agent-based scanning
Security baseline scanning
OWASP application guidance
Dynamic analysis

Correct answer: B

Why: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. It directly fits this scenario because the requirement is to assess remote endpoints that are not reliably reachable by the scanner.

Option review:

A: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

B: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. It directly fits this scenario because the requirement is to assess remote endpoints that are not reliably reachable by the scanner.

C: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

D: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

E: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

Learning point: Use Agent-based scanning when the key requirement is to assess remote endpoints that are not reliably reachable by the scanner.

Question 10

In a regional distribution network, a security engineer must assess many reachable systems without installing software on each endpoint. Which approach is MOST appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

Non-credentialed scanning
OWASP application guidance
Passive discovery
Agentless scanning
Regulatory scanning requirement

Correct answer: D

Why: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. It directly fits this scenario because the requirement is to assess many reachable systems without installing software on each endpoint.

Option review:

A: Unauthenticated scans approximate what an external attacker can observe without valid credentials. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint.

B: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint.

C: Passive techniques observe existing traffic and metadata without actively probing target systems. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint.

D: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. It directly fits this scenario because the requirement is to assess many reachable systems without installing software on each endpoint.

E: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint.

Learning point: Use Agentless scanning when the key requirement is to assess many reachable systems without installing software on each endpoint.

Question 11

A review at Alpine Ski House finds a gap: the team cannot reliably obtain deeper system-level vulnerability evidence instead of relying only on exposed services. Which option best closes that gap? Assume the activity is authorized and must follow normal enterprise change control.

Credentialed scanning
OT/ICS/SCADA scanning precautions
CIS benchmark alignment
Network map scan
Regulatory scanning requirement

Correct answer: A

Why: Authenticated scans use valid credentials to inspect configuration, patch state, packages, and local settings with greater depth. It directly fits this scenario because the requirement is to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

Option review:

A: Authenticated scans use valid credentials to inspect configuration, patch state, packages, and local settings with greater depth. It directly fits this scenario because the requirement is to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

B: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

C: CIS Benchmarks provide prescriptive secure-configuration recommendations for many operating systems, platforms, and applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

D: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

E: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

Learning point: Use Credentialed scanning when the key requirement is to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

Question 12

At Coho Winery, a systems security analyst has two simultaneous requirements: measure exposure from the perspective of a party with no login, and align a vulnerability-management process with an information-security management framework. Which TWO options should be selected? Assume no additional product-specific features are available beyond the concepts listed.

Scan scheduling
Security baseline scanning
Dynamic analysis
ISO 27000-series alignment
Non-credentialed scanning

Correct answers: D, E

Why: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. It directly fits this scenario because the requirement is to align a vulnerability-management process with an information-security management framework. Unauthenticated scans approximate what an external attacker can observe without valid credentials. It directly fits this scenario because the requirement is to measure exposure from the perspective of a party with no login.

Option review:

A: Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login; align a vulnerability-management process with an information-security management framework.

B: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login; align a vulnerability-management process with an information-security management framework.

C: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login; align a vulnerability-management process with an information-security management framework.

D: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. It directly fits this scenario because the requirement is to align a vulnerability-management process with an information-security management framework.

E: Unauthenticated scans approximate what an external attacker can observe without valid credentials. It directly fits this scenario because the requirement is to measure exposure from the perspective of a party with no login.

Learning point: Use Non-credentialed scanning, ISO 27000-series alignment when the key requirement is to measure exposure from the perspective of a party with no login; align a vulnerability-management process with an information-security management framework.

Question 13

While supporting a manufacturing plant, an incident responder is asked to discover assets in fragile environments where active probing could be risky. Which concept or tool is the clearest match? The organization wants a vendor-neutral approach that can be explained during audit review.

OT/ICS/SCADA scanning precautions
Agent-based scanning
Device fingerprinting
OWASP application guidance
Passive discovery

Correct answer: E

Option review:

A: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

B: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

C: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

D: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

E: Passive techniques observe existing traffic and metadata without actively probing target systems. It directly fits this scenario because the requirement is to discover assets in fragile environments where active probing could be risky.

Learning point: Use Passive discovery when the key requirement is to discover assets in fragile environments where active probing could be risky.

Question 14

A new security procedure at Fourth Coffee must enable analysts to directly query systems to identify reachable services and weaknesses. Which option is the BEST choice? Base the decision on the primary security requirement, not on implementation convenience.

Reverse engineering
Internal scanning
Active scanning
ISO 27000-series alignment
Security baseline scanning

Correct answer: C

Why: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. It directly fits this scenario because the requirement is to directly query systems to identify reachable services and weaknesses.

Option review:

A: Reverse engineering analyzes binaries or behavior to understand implementation, logic, or vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to directly query systems to identify reachable services and weaknesses.

B: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to directly query systems to identify reachable services and weaknesses.

C: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. It directly fits this scenario because the requirement is to directly query systems to identify reachable services and weaknesses.

D: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to directly query systems to identify reachable services and weaknesses.

E: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to directly query systems to identify reachable services and weaknesses.

Learning point: Use Active scanning when the key requirement is to directly query systems to identify reachable services and weaknesses.

Question 15

During a security review, a response lead must address two separate needs: inspect software for weaknesses without running it, and avoid disrupting a critical system while still obtaining current vulnerability data. Select TWO. The environment follows least privilege and preserves evidence where incident handling is involved.

Security baseline scanning
ISO 27000-series alignment
Static analysis
Network map scan
Scan scheduling

Correct answers: C, E

Why: Static analysis examines code or binaries without executing them. It directly fits this scenario because the requirement is to inspect software for weaknesses without running it. Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. It directly fits this scenario because the requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

Option review:

A: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect software for weaknesses without running it; avoid disrupting a critical system while still obtaining current vulnerability data.

B: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect software for weaknesses without running it; avoid disrupting a critical system while still obtaining current vulnerability data.

C: Static analysis examines code or binaries without executing them. It directly fits this scenario because the requirement is to inspect software for weaknesses without running it.

D: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect software for weaknesses without running it; avoid disrupting a critical system while still obtaining current vulnerability data.

E: Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. It directly fits this scenario because the requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

Learning point: Use Static analysis, Scan scheduling when the key requirement is to inspect software for weaknesses without running it; avoid disrupting a critical system while still obtaining current vulnerability data.

Question 16

At Adventure Works, a blue-team analyst needs to observe how an application behaves under malformed or unexpected inputs. Which option is the BEST fit for a hybrid-cloud workload? Use the choice that most directly addresses the stated evidence rather than a broader control.

Security baseline scanning
ISO 27000-series alignment
Dynamic analysis
Active scanning
Passive discovery

Correct answer: C

Why: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. It directly fits this scenario because the requirement is to observe how an application behaves under malformed or unexpected inputs.

Option review:

A: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe how an application behaves under malformed or unexpected inputs.

B: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe how an application behaves under malformed or unexpected inputs.

C: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. It directly fits this scenario because the requirement is to observe how an application behaves under malformed or unexpected inputs.

D: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe how an application behaves under malformed or unexpected inputs.

E: Passive techniques observe existing traffic and metadata without actively probing target systems. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to observe how an application behaves under malformed or unexpected inputs.

Learning point: Use Dynamic analysis when the key requirement is to observe how an application behaves under malformed or unexpected inputs.

Question 17

During an investigation at Wide World Importers, the immediate requirement is to understand how a compiled component works when source code is unavailable. What should an incident coordinator select? The team wants the most defensible analyst action before expanding the investigation.

Passive discovery
Static analysis
Dynamic analysis
Reverse engineering
Agent-based scanning

Correct answer: D

Why: Reverse engineering analyzes binaries or behavior to understand implementation, logic, or vulnerability conditions. It directly fits this scenario because the requirement is to understand how a compiled component works when source code is unavailable.

Option review:

A: Passive techniques observe existing traffic and metadata without actively probing target systems. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to understand how a compiled component works when source code is unavailable.

B: Static analysis examines code or binaries without executing them. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to understand how a compiled component works when source code is unavailable.

C: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to understand how a compiled component works when source code is unavailable.

D: Reverse engineering analyzes binaries or behavior to understand implementation, logic, or vulnerability conditions. It directly fits this scenario because the requirement is to understand how a compiled component works when source code is unavailable.

E: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to understand how a compiled component works when source code is unavailable.

Learning point: Use Reverse engineering when the key requirement is to understand how a compiled component works when source code is unavailable.

Question 18

Datum Fabrication is designing a combined control. It must assess industrial control assets without jeopardizing availability or safety, and schedule and document scans to satisfy an external compliance obligation. Which TWO options are most appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

Performance-aware scanning
OT/ICS/SCADA scanning precautions
Internal scanning
Security baseline scanning
Regulatory scanning requirement

Correct answers: B, E

Why: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. It directly fits this scenario because the requirement is to assess industrial control assets without jeopardizing availability or safety. Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. It directly fits this scenario because the requirement is to schedule and document scans to satisfy an external compliance obligation.

Option review:

A: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess industrial control assets without jeopardizing availability or safety; schedule and document scans to satisfy an external compliance obligation.

B: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. It directly fits this scenario because the requirement is to assess industrial control assets without jeopardizing availability or safety.

C: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess industrial control assets without jeopardizing availability or safety; schedule and document scans to satisfy an external compliance obligation.

D: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess industrial control assets without jeopardizing availability or safety; schedule and document scans to satisfy an external compliance obligation.

E: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. It directly fits this scenario because the requirement is to schedule and document scans to satisfy an external compliance obligation.

Learning point: Use OT/ICS/SCADA scanning precautions, Regulatory scanning requirement when the key requirement is to assess industrial control assets without jeopardizing availability or safety; schedule and document scans to satisfy an external compliance obligation.

Question 19

During a security review, a SOC lead must address two separate needs: find systems that no longer match the organization secure configuration standard, and measure vulnerabilities reachable from inside the enterprise network. Select TWO. Assume the activity is authorized and must follow normal enterprise change control.

Security baseline scanning
OT/ICS/SCADA scanning precautions
Sensitivity and segmentation planning
Internal scanning
ISO 27000-series alignment

Correct answers: A, D

Why: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. It directly fits this scenario because the requirement is to find systems that no longer match the organization secure configuration standard. Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. It directly fits this scenario because the requirement is to measure vulnerabilities reachable from inside the enterprise network.

Option review:

A: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. It directly fits this scenario because the requirement is to find systems that no longer match the organization secure configuration standard.

B: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to find systems that no longer match the organization secure configuration standard; measure vulnerabilities reachable from inside the enterprise network.

C: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to find systems that no longer match the organization secure configuration standard; measure vulnerabilities reachable from inside the enterprise network.

D: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. It directly fits this scenario because the requirement is to measure vulnerabilities reachable from inside the enterprise network.

E: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to find systems that no longer match the organization secure configuration standard; measure vulnerabilities reachable from inside the enterprise network.

Learning point: Use Security baseline scanning, Internal scanning when the key requirement is to find systems that no longer match the organization secure configuration standard; measure vulnerabilities reachable from inside the enterprise network.

Question 20

In a restricted research segment, a malware analyst must assess a cardholder-data environment against payment-industry requirements. Which approach is MOST appropriate? Assume no additional product-specific features are available beyond the concepts listed.

Static analysis
Regulatory scanning requirement
PCI DSS alignment
Active scanning
Dynamic analysis

Correct answer: C

Why: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. It directly fits this scenario because the requirement is to assess a cardholder-data environment against payment-industry requirements.

Option review:

A: Static analysis examines code or binaries without executing them. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess a cardholder-data environment against payment-industry requirements.

B: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess a cardholder-data environment against payment-industry requirements.

C: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. It directly fits this scenario because the requirement is to assess a cardholder-data environment against payment-industry requirements.

D: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess a cardholder-data environment against payment-industry requirements.

E: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess a cardholder-data environment against payment-industry requirements.

Learning point: Use PCI DSS alignment when the key requirement is to assess a cardholder-data environment against payment-industry requirements.

Question 21

A review at Wingtip Services finds a gap: the team cannot reliably compare system configuration against a widely used hardening benchmark. Which option best closes that gap? The organization wants a vendor-neutral approach that can be explained during audit review.

Security baseline scanning
Device fingerprinting
CIS benchmark alignment
OWASP application guidance
Internal scanning

Correct answer: C

Option review:

A: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to compare system configuration against a widely used hardening benchmark.

B: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to compare system configuration against a widely used hardening benchmark.

C: CIS Benchmarks provide prescriptive secure-configuration recommendations for many operating systems, platforms, and applications. It directly fits this scenario because the requirement is to compare system configuration against a widely used hardening benchmark.

D: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to compare system configuration against a widely used hardening benchmark.

E: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to compare system configuration against a widely used hardening benchmark.

Learning point: Use CIS benchmark alignment when the key requirement is to compare system configuration against a widely used hardening benchmark.

Question 22

a threat hunter at Woodgrove Bank is comparing several approaches. The deciding requirement is to structure web-application assessment around common application-security weaknesses. Which option should be chosen? Base the decision on the primary security requirement, not on implementation convenience.

OT/ICS/SCADA scanning precautions
Device fingerprinting
OWASP application guidance
Network map scan
Active scanning

Correct answer: C

Why: OWASP resources help identify and test common web-application security risks. It directly fits this scenario because the requirement is to structure web-application assessment around common application-security weaknesses.

Option review:

A: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to structure web-application assessment around common application-security weaknesses.

B: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to structure web-application assessment around common application-security weaknesses.

C: OWASP resources help identify and test common web-application security risks. It directly fits this scenario because the requirement is to structure web-application assessment around common application-security weaknesses.

D: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to structure web-application assessment around common application-security weaknesses.

E: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to structure web-application assessment around common application-security weaknesses.

Learning point: Use OWASP application guidance when the key requirement is to structure web-application assessment around common application-security weaknesses.

Question 23

While supporting a regulated customer-data environment, a risk analyst is asked to align a vulnerability-management process with an information-security management framework. Which concept or tool is the clearest match? The environment follows least privilege and preserves evidence where incident handling is involved.

Credentialed scanning
ISO 27000-series alignment
Performance-aware scanning
Non-credentialed scanning
Internal scanning

Correct answer: B

Option review:

A: Authenticated scans use valid credentials to inspect configuration, patch state, packages, and local settings with greater depth. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to align a vulnerability-management process with an information-security management framework.

B: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. It directly fits this scenario because the requirement is to align a vulnerability-management process with an information-security management framework.

C: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to align a vulnerability-management process with an information-security management framework.

D: Unauthenticated scans approximate what an external attacker can observe without valid credentials. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to align a vulnerability-management process with an information-security management framework.

E: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to align a vulnerability-management process with an information-security management framework.

Learning point: Use ISO 27000-series alignment when the key requirement is to align a vulnerability-management process with an information-security management framework.

Question 24

A new security procedure at Contoso Health must enable analysts to identify live systems and exposed network services across an address range. Which option is the BEST choice? Use the choice that most directly addresses the stated evidence rather than a broader control.

Performance-aware scanning
Static analysis
External scanning
Network map scan
Regulatory scanning requirement

Correct answer: D

Option review:

A: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

B: Static analysis examines code or binaries without executing them. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

D: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. It directly fits this scenario because the requirement is to identify live systems and exposed network services across an address range.

E: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify live systems and exposed network services across an address range.

Learning point: Use Network map scan when the key requirement is to identify live systems and exposed network services across an address range.

Question 25

For an airline operations network, the team must accomplish both of these goals: classify discovered assets when inventory data is incomplete, and discover assets in fragile environments where active probing could be risky. Which TWO choices together provide the best match? The team wants the most defensible analyst action before expanding the investigation.

Passive discovery
OT/ICS/SCADA scanning precautions
Static analysis
OWASP application guidance
Device fingerprinting

Correct answers: A, E

Why: Passive techniques observe existing traffic and metadata without actively probing target systems. It directly fits this scenario because the requirement is to discover assets in fragile environments where active probing could be risky. Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. It directly fits this scenario because the requirement is to classify discovered assets when inventory data is incomplete.

Option review:

A: Passive techniques observe existing traffic and metadata without actively probing target systems. It directly fits this scenario because the requirement is to discover assets in fragile environments where active probing could be risky.

B: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete; discover assets in fragile environments where active probing could be risky.

C: Static analysis examines code or binaries without executing them. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete; discover assets in fragile environments where active probing could be risky.

D: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to classify discovered assets when inventory data is incomplete; discover assets in fragile environments where active probing could be risky.

E: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. It directly fits this scenario because the requirement is to classify discovered assets when inventory data is incomplete.

Learning point: Use Device fingerprinting, Passive discovery when the key requirement is to classify discovered assets when inventory data is incomplete; discover assets in fragile environments where active probing could be risky.

Question 26

At Lucerne Publishing, a detection engineer needs to avoid disrupting a critical system while still obtaining current vulnerability data. Which option is the BEST fit for a remote-work environment? Select based on the scenario’s decisive constraint, not on which technology is newest.

Device fingerprinting
Scan scheduling
OT/ICS/SCADA scanning precautions
Agent-based scanning
Reverse engineering

Correct answer: B

Option review:

B: Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. It directly fits this scenario because the requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

C: Industrial and operational systems may be safety-critical or fragile, so passive discovery, vendor guidance, and tightly controlled active testing are often necessary. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

D: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

E: Reverse engineering analyzes binaries or behavior to understand implementation, logic, or vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid disrupting a critical system while still obtaining current vulnerability data.

Learning point: Use Scan scheduling when the key requirement is to avoid disrupting a critical system while still obtaining current vulnerability data.

Question 27

During an investigation at Fabrikam Finance, the immediate requirement is to reduce the chance that assessment traffic degrades production performance. What should a vulnerability analyst select? Assume the activity is authorized and must follow normal enterprise change control.

Network map scan
Performance-aware scanning
Agent-based scanning
Regulatory scanning requirement
Dynamic analysis

Correct answer: B

Option review:

A: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

B: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. It directly fits this scenario because the requirement is to reduce the chance that assessment traffic degrades production performance.

C: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

E: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the chance that assessment traffic degrades production performance.

Learning point: Use Performance-aware scanning when the key requirement is to reduce the chance that assessment traffic degrades production performance.

Question 28

City Power Utilities is updating its security operations standard for a segmented industrial environment. Which option most directly helps the team adapt scanning for highly sensitive or isolated network segments? Assume no additional product-specific features are available beyond the concepts listed.

Regulatory scanning requirement
External scanning
Active scanning
Sensitivity and segmentation planning
Security baseline scanning

Correct answer: D

Option review:

A: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

B: External scans evaluate the internet-facing attack surface from outside the organization. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

C: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

D: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. It directly fits this scenario because the requirement is to adapt scanning for highly sensitive or isolated network segments.

E: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to adapt scanning for highly sensitive or isolated network segments.

Learning point: Use Sensitivity and segmentation planning when the key requirement is to adapt scanning for highly sensitive or isolated network segments.

Question 29

A ticket at A. Datum Logistics asks a security consultant to schedule and document scans to satisfy an external compliance obligation. Which choice addresses the requirement most directly? The organization wants a vendor-neutral approach that can be explained during audit review.

Sensitivity and segmentation planning
Agentless scanning
Passive discovery
Regulatory scanning requirement
Scan scheduling

Correct answer: D

Option review:

A: Sensitive systems and segmented networks may require tailored credentials, routing, approvals, and lower-impact techniques. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

B: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

C: Passive techniques observe existing traffic and metadata without actively probing target systems. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

D: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. It directly fits this scenario because the requirement is to schedule and document scans to satisfy an external compliance obligation.

E: Scan timing should account for maintenance windows, operational impact, business cycles, and change activity. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule and document scans to satisfy an external compliance obligation.

Learning point: Use Regulatory scanning requirement when the key requirement is to schedule and document scans to satisfy an external compliance obligation.

Question 30

In a regional distribution network, a security engineer must measure vulnerabilities reachable from inside the enterprise network. Which approach is MOST appropriate? Base the decision on the primary security requirement, not on implementation convenience.

Static analysis
External scanning
Security baseline scanning
CIS benchmark alignment
Internal scanning

Correct answer: E

Option review:

B: External scans evaluate the internet-facing attack surface from outside the organization. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

C: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

D: CIS Benchmarks provide prescriptive secure-configuration recommendations for many operating systems, platforms, and applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure vulnerabilities reachable from inside the enterprise network.

E: Internal scans evaluate exposures visible from trusted or internal network positions and can find issues not exposed to the internet. It directly fits this scenario because the requirement is to measure vulnerabilities reachable from inside the enterprise network.

Learning point: Use Internal scanning when the key requirement is to measure vulnerabilities reachable from inside the enterprise network.

Question 31

A review at Alpine Ski House finds a gap: the team cannot reliably identify weaknesses visible to an unauthenticated internet-based attacker. Which option best closes that gap? The environment follows least privilege and preserves evidence where incident handling is involved.

Credentialed scanning
Network map scan
PCI DSS alignment
External scanning
OWASP application guidance

Correct answer: D

Option review:

A: Authenticated scans use valid credentials to inspect configuration, patch state, packages, and local settings with greater depth. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

C: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

D: External scans evaluate the internet-facing attack surface from outside the organization. It directly fits this scenario because the requirement is to identify weaknesses visible to an unauthenticated internet-based attacker.

E: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify weaknesses visible to an unauthenticated internet-based attacker.

Learning point: Use External scanning when the key requirement is to identify weaknesses visible to an unauthenticated internet-based attacker.

Question 32

a systems security analyst at Coho Winery is comparing several approaches. The deciding requirement is to assess remote endpoints that are not reliably reachable by the scanner. Which option should be chosen? Use the choice that most directly addresses the stated evidence rather than a broader control.

Agent-based scanning
CIS benchmark alignment
Performance-aware scanning
Agentless scanning
Security baseline scanning

Correct answer: A

Option review:

A: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. It directly fits this scenario because the requirement is to assess remote endpoints that are not reliably reachable by the scanner.

B: CIS Benchmarks provide prescriptive secure-configuration recommendations for many operating systems, platforms, and applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

C: Scan rate, concurrency, and depth should be tuned so assessment traffic does not overload constrained systems or links. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

D: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

E: Baseline scanning compares configuration against an approved hardened standard to identify drift and misconfiguration. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess remote endpoints that are not reliably reachable by the scanner.

Learning point: Use Agent-based scanning when the key requirement is to assess remote endpoints that are not reliably reachable by the scanner.

Question 33

For a manufacturing plant, the team must accomplish both of these goals: assess many reachable systems without installing software on each endpoint, and compare system configuration against a widely used hardening benchmark. Which TWO choices together provide the best match? The team wants the most defensible analyst action before expanding the investigation.

Device fingerprinting
Regulatory scanning requirement
CIS benchmark alignment
Dynamic analysis
Agentless scanning

Correct answers: C, E

Why: CIS Benchmarks provide prescriptive secure-configuration recommendations for many operating systems, platforms, and applications. It directly fits this scenario because the requirement is to compare system configuration against a widely used hardening benchmark. Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. It directly fits this scenario because the requirement is to assess many reachable systems without installing software on each endpoint.

Option review:

A: Fingerprinting infers device, operating system, service, or application characteristics from observed behavior and responses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint; compare system configuration against a widely used hardening benchmark.

B: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint; compare system configuration against a widely used hardening benchmark.

D: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to assess many reachable systems without installing software on each endpoint; compare system configuration against a widely used hardening benchmark.

E: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. It directly fits this scenario because the requirement is to assess many reachable systems without installing software on each endpoint.

Learning point: Use Agentless scanning, CIS benchmark alignment when the key requirement is to assess many reachable systems without installing software on each endpoint; compare system configuration against a widely used hardening benchmark.

Question 34

A new security procedure at Fourth Coffee must enable analysts to obtain deeper system-level vulnerability evidence instead of relying only on exposed services. Which option is the BEST choice? Select based on the scenario’s decisive constraint, not on which technology is newest.

Credentialed scanning
ISO 27000-series alignment
Active scanning
Agent-based scanning
Dynamic analysis

Correct answer: A

Option review:

B: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

C: Active scanning sends probes to targets to enumerate services, versions, and vulnerability conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

D: An installed agent can assess endpoint state with local visibility even when the device is remote or intermittently connected. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

E: Dynamic analysis observes software while it executes and can include fuzzing or runtime testing. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

Learning point: Use Credentialed scanning when the key requirement is to obtain deeper system-level vulnerability evidence instead of relying only on exposed services.

Question 35

The primary objective for Consolidated Messenger is to measure exposure from the perspective of a party with no login. Which selection best satisfies that objective in a customer-facing messaging service? Assume the activity is authorized and must follow normal enterprise change control.

PCI DSS alignment
Agentless scanning
Passive discovery
ISO 27000-series alignment
Non-credentialed scanning

Correct answer: E

Why: Unauthenticated scans approximate what an external attacker can observe without valid credentials. It directly fits this scenario because the requirement is to measure exposure from the perspective of a party with no login.

Option review:

A: PCI DSS provides security requirements for environments that store, process, or transmit payment-card data. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login.

B: Agentless scanning queries systems remotely and avoids deploying local scanning software, but depends on reachability and permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login.

C: Passive techniques observe existing traffic and metadata without actively probing target systems. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login.

D: The ISO 27000 family provides information-security management standards and guidance that can influence control and assessment programs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to measure exposure from the perspective of a party with no login.

Learning point: Use Non-credentialed scanning when the key requirement is to measure exposure from the perspective of a party with no login.

Question 36

At Adventure Works, a blue-team analyst needs to discover assets in fragile environments where active probing could be risky. Which option is the BEST fit for a hybrid-cloud workload? Assume no additional product-specific features are available beyond the concepts listed.

Network map scan
Regulatory scanning requirement
OWASP application guidance
CIS benchmark alignment
Passive discovery

Correct answer: E

Option review:

A: Network mapping discovers reachable hosts, addresses, services, and topology clues before deeper assessment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

B: Some obligations prescribe scan scope, frequency, evidence, or validation, so the scan plan must reflect the applicable requirement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

C: OWASP resources help identify and test common web-application security risks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

D: CIS Benchmarks provide prescriptive secure-configuration recommendations for many operating systems, platforms, and applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to discover assets in fragile environments where active probing could be risky.

Learning point: Use Passive discovery when the key requirement is to discover assets in fragile environments where active probing could be risky.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Question 31

Question 32

Question 33

Question 34

Question 35

Question 36

Related posts: