CompTIA Security Plus Mock Test Q694

A set of standardized system images with a pre-defined set of applications is used to build end-user workstations. The security administrator has scanned every workstation to create a current inventory of all applications that are installed on active workstations and is documenting which applications are out-of-date and could be exploited. The security administrator is determining the:

A. attack surface.
B. application hardening effectiveness.
C. application baseline.
D. OS hardening effectiveness.


Correct Answer: A
Section: Threats and Vulnerabilities

Explanation:
In this question, we have out-of-date applications that could be exploited. The out-of-date applications are security vulnerabilities. The combination of all vulnerabilities that could be
exploited (or attacked) is known as the attack surface.
The attack surface of a software environment is the sum of the different points (the “attack vectors”) where an unauthorized user (the “attacker”) can try to enter data to or extract data
from an environment.
The basic strategies of attack surface reduction are to reduce the amount of code running, reduce entry points available to untrusted users, and eliminate services requested by
relatively few users. One approach to improving information security is to reduce the attack surface of a system or software. By turning off unnecessary functionality, there are fewer
security risks. By having less code available to unauthorized actors, there will tend to be fewer failures. Although attack surface reduction helps prevent security failures, it does not
mitigate the amount of damage an attacker could inflict once a vulnerability is found.

Incorrect Answers:
B: Determining the application hardening effectiveness would be the process of testing an application for vulnerabilities after it has been updated or patched (hardened). In this
question, the applications are out-of-date so they have not been ‘hardened’.
C: An application baseline is a standard configuration for an application or set of applications. The process of documenting which applications are out-of-date and could be exploited is
not performed to determine an application baseline.
D: Determining the OS (operating system) hardening effectiveness would be the process of testing an OS for vulnerabilities after it has been updated or patched (hardened). In this
question, nothing has been done to harden the OS. The process of documenting which applications are out-of-date and could be exploited is not performed to determine OS hardening
effectiveness.

References:
https://en.wikipedia.org/wiki/Attack_surface