D329 Networks and Security Applications - Set 2 - Part 3

Correct Answer: A flaw with no available patch at the time it becomes known or exploited

A zero-day is a vulnerability for which no vendor fix yet exists, so defenders have zero days of advance notice to remediate before exploitation.

Correct Answer: The systematic process of applying software updates that fix vulnerabilities

Patch management identifies, tests, and deploys security updates in a timely, controlled manner, closing known vulnerabilities before attackers exploit them.

Correct Answer: Most successful attacks exploit known vulnerabilities with available patches

The large majority of breaches exploit vulnerabilities for which patches already existed, so disciplined patching removes the most commonly used attack paths.

Correct Answer: An automated assessment identifying known weaknesses in systems

A vulnerability scan compares system configurations and software versions against known vulnerability databases, producing a prioritized list of weaknesses.

Correct Answer: A penetration test attempts to actively exploit weaknesses to demonstrate impact

A vulnerability scan identifies potential weaknesses, while a penetration test attempts controlled exploitation to confirm which are genuinely exploitable and what impact results.

Correct Answer: Manipulating people to bypass technical security controls

Social engineering targets human trust and helpfulness rather than technical flaws, using deception to obtain credentials, information, or physical access.

Correct Answer: Following an authorized person through a secured door without credentials

Tailgating exploits courtesy, with an unauthorized person following an authorized individual through a controlled door before it closes.

Correct Answer: Defining how the organization detects, contains, and recovers from security incidents

An incident response plan establishes roles, procedures, and communication paths so incidents are handled quickly and consistently rather than improvised under pressure.

Correct Answer: Containing the incident to prevent further damage

After identification, containment limits ongoing damage and prevents spread, while preserving evidence for the subsequent eradication and recovery phases.

Correct Answer: It supports root cause analysis and any legal or regulatory action

Forensic evidence establishes how the breach occurred and its scope, informing remediation and supporting legal, insurance, and regulatory processes.