D340 Cyber Defense and Countermeasures - Set 1 - Part 2

Correct Answer: Disabling and removing unnecessary services, accounts, and software

Every unnecessary service or account is a potential entry point. Removing what is not needed eliminates those paths entirely rather than merely monitoring them.

Correct Answer: The specific path or method used to gain unauthorized access

An attack vector is the route by which an attacker reaches a target, such as a phishing email, an exposed service, or a compromised supplier.

Correct Answer: A weakness that could be exploited to compromise a system

A vulnerability is a flaw in design, implementation, or configuration that a threat could exploit to violate security objectives.

Correct Answer: Risk arises when a threat can exploit a vulnerability affecting an asset

A threat is a potential danger, a vulnerability is an exploitable weakness, and risk is the likelihood and impact of a threat exploiting that vulnerability.

Correct Answer: Scoring the severity of vulnerabilities on a standardized scale

The Common Vulnerability Scoring System provides a standardized severity score based on exploitability and impact, supporting consistent prioritization.

Correct Answer: Business context and exploitability in your environment also matter

A high-scoring vulnerability on an isolated test system may matter less than a moderate one on an internet-facing critical asset, so context must inform prioritization.

Correct Answer: A unique reference number for a publicly known vulnerability

Common Vulnerabilities and Exposures identifiers give each publicly disclosed vulnerability a unique reference, enabling unambiguous communication across tools and vendors.

Correct Answer: Code or a technique that takes advantage of a vulnerability

An exploit is the specific method or code that leverages a vulnerability to produce unintended behavior such as code execution or privilege escalation.

Correct Answer: Code demonstrating a vulnerability is exploitable without full weaponization

A proof of concept demonstrates exploitability to validate the vulnerability, typically without the payload and evasion of a production attack tool.

Correct Answer: It dramatically lowers the skill required to attack the vulnerability

Once working exploit code circulates publicly, attacks scale rapidly because low-skill attackers can use it, compressing the safe remediation window.

Correct Answer: A safeguard implemented to reduce risk

A security control is any administrative, technical, or physical safeguard implemented to reduce the likelihood or impact of a risk.

Correct Answer: A policy, procedure, or training that governs behavior

Administrative controls are policies, standards, procedures, and training that direct how people work securely, complementing technical and physical safeguards.

Correct Answer: A safeguard implemented through technology such as encryption or access control

Technical controls use technology to enforce security, including authentication systems, encryption, firewalls, and logging.

Correct Answer: An alternative safeguard used when the primary control is not feasible

A compensating control provides comparable protection when the standard control cannot be implemented, such as enhanced monitoring where patching is impossible.

Correct Answer: A measure discouraging attackers from attempting an attack

Deterrent controls such as warning banners and visible cameras discourage attempts by increasing perceived risk to the attacker.

Correct Answer: A measure that restores systems after an incident

Corrective controls restore normal operation after an incident, including backups, disaster recovery procedures, and patches applied post-compromise.

Correct Answer: Providing a structured approach to managing cybersecurity risk

Frameworks provide a common structure and vocabulary for identifying, protecting, detecting, responding, and recovering, adaptable to any organization's context.

Correct Answer: Identify, Protect, Detect, Respond, Recover

The framework organizes cybersecurity activity into Identify, Protect, Detect, Respond, and Recover, spanning prevention through restoration.

Correct Answer: You cannot protect assets and risks you have not identified

Without an accurate inventory of assets, data, and risks, protective and detective controls will inevitably leave unknown gaps unaddressed.

Correct Answer: Establishing what must be protected and monitored

An accurate, current asset inventory is foundational, because unknown systems are unpatched, unmonitored, and frequently the point of compromise.