100-160 Question 186
Select 3A cybersecurity analyst is reviewing threat intelligence reports and discovers that a new vulnerability has been identified in a commonly used web server software. To determine if this vulnerability could affect their organization's network, which of the following steps should they take?
- A
Compare the vulnerability details with the organization's software inventory.
- B
Search for exploit code related to the vulnerability in underground forums.
- C
Update the organization's incident response plan immediately.
- D
Check if the affected software version is running on any systems within the network.
- E
Analyze network traffic logs for unusual activity related to the vulnerability.
Show answer and explanation
Correct answers: A, D, E
Explanation
To identify potential network vulnerabilities using threat intelligence, it is essential to determine if the vulnerability applies to your organization's systems. This involves comparing the vulnerability details with the software inventory, checking if the affected version is in use, and analyzing network traffic for signs of exploitation. These steps ensure a targeted and efficient response to emerging threats.
- A. Correct.
Correct: Comparing the vulnerability details with the organization's software inventory helps identify if the specific software version exists and could be exploited.
- B. Incorrect.
Incorrect: Searching for exploit code in underground forums may not be a direct step in identifying potential vulnerabilities and could expose analysts to malicious content.
- C. Incorrect.
Incorrect: Updating the organization's incident response plan is not immediately necessary unless the vulnerability poses a critical risk and is confirmed to affect the organization.
- D. Correct.
Correct: Checking if the affected software version is running on any systems is crucial to determine potential exposure to the vulnerability.
- E. Correct.
Correct: Analyzing network traffic logs for unusual activity related to the vulnerability can help identify if attempts to exploit the vulnerability have already occurred.