7 Security Tools and Operational Exercises Online Quiz Questions

Remove all permissions and check whether the workload still runs.

Test the task-specific policy in a simulator or sandbox, confirming a required action succeeds and an unrelated action is denied.

Grant administrator access temporarily so the task can be completed without permission errors.

Delete the identity and create a new one with the same broad permissions.

The host has no vulnerabilities because every selected check passed.

The host is secure as long as the baseline tool completed without errors.

The host passed the selected checks in the chosen profile, but other weaknesses may remain.

The baseline is unsuitable for the host because it did not identify any failed checks.

Combine severity with exploitability, business importance, exposure, and available mitigations.

Fix findings in severity order without considering the affected assets.

Upgrade immediately to the scanner's suggested fixed version without testing.

Defer any finding that does not have a known fixed version.

Deploy the suggested version directly because a scanner's fixed-version result proves the issue is resolved.

Verify the component and version, test an appropriate change, deploy through the normal process, and rescan the correct artifact or asset.

Ignore the result unless the scanner labels it critical.

Close the finding after documenting the suggested fixed version, without changing or checking the asset.

Review permissions for broad access and unexpected trust relationships.

Remove every old permission immediately, before checking whether anything depends on it.

Record the identity's owner, purpose, review date, and a rollback plan.

Give each identity administrative access while reviewing its permissions.

Search relevant audit events for the actor, time, source, action, affected resource, and outcome.

Correlate the event with related system or application logs where available.

Declare an incident as soon as an alert fires, without checking other evidence.

Compare the alert with independent evidence and normal activity before deciding what it means.

True

False

True

False

Accept every finding as confirmed because the tool generated it.

Validate the finding, consider business context and exposure, and record what was checked and changed.

Dismiss findings that cannot be fixed immediately.

Treat the tool's severity rating as the complete risk assessment.

OpenSCAP, for assessing host configuration against a baseline

IAM Access Analyzer, for reviewing trust relationships and unintended external access

CloudTrail, for recording AWS API activity

Trivy, for scanning a local project or container image for vulnerabilities

Grant broad administrative access first, then remove permissions if a problem occurs

Apply the policy directly to production and check only whether the required action works

Test in a simulator or sandbox, confirming the required action succeeds and an unrelated action is denied

Remove all existing permissions and rely on application logs to identify what broke

Treat the scanner’s suggested fixed version as proof the issue is resolved

Verify the affected component and version, consider exposure and exploitability, and re-scan the correct artifact after a change

Prioritize findings by severity alone, then upgrade every affected dependency immediately

Ignore whether the component is present or reachable if the scanner reports a finding

True

False