200-201 Question 46
Select 2A cybersecurity analyst discovers that an outdated web server in the organization is running software with a publicly disclosed vulnerability. The analyst confirms that an exploit for this vulnerability already exists. Which of the following steps should the analyst prioritize to reduce the organization's exposure to this vulnerability?
- A
Apply the latest security patches to the web server.
- B
Isolate the web server from the network until the issue is resolved.
- C
Contact the software vendor to confirm the vulnerability's details.
- D
Monitor traffic to the web server for signs of exploitation.
- E
Update the organization's incident response plan.
Show answer and explanation
Correct answers: A, B
Explanation
The analyst should prioritize immediate actions to reduce the risk of exploitation. Applying security patches directly addresses the vulnerability, while isolating the web server prevents potential exploitation in the interim. These steps align with best practices for vulnerability management and incident prevention.
- A. Correct.
Applying the latest security patches will address the vulnerability if a fix is available, which is a critical step in mitigating the risk.
- B. Correct.
Isolating the web server from the network minimizes the attack surface and prevents potential exploitation while the issue is being resolved.
- C. Incorrect.
While contacting the vendor can provide additional details, it does not immediately reduce the risk of exploitation and is not a priority in this context.
- D. Incorrect.
Monitoring for exploitation is important but is reactive rather than proactive. It does not reduce the risk of the vulnerability being exploited.
- E. Incorrect.
Updating the incident response plan is a good practice but does not directly address the immediate threat posed by the vulnerability.