CAS-002 · Question #145
Company XYZ has transferred all of the corporate servers, including web servers, to a cloud hosting provider to reduce costs. All of the servers are running unpatched, outdated versions of Apache…
The correct answer is A. All servers are unpatched and running old versions. Running unpatched, outdated Apache servers exposes the environment to publicly known exploits with available attack tools, making it the most immediately exploitable and significant risk. Encryption at rest and disabled logging are concerns, but they do not represent active…
Question
Company XYZ has transferred all of the corporate servers, including web servers, to a cloud hosting provider to reduce costs. All of the servers are running unpatched, outdated versions of Apache. Furthermore, the corporate financial data is also hosted by the cloud services provider, but it is encrypted when not in use. Only the DNS server is configured to audit user and administrator actions and logging is disabled on the other virtual machines. Given this scenario, which of the following is the MOST significant risk to the system?
Options
- AAll servers are unpatched and running old versions.
- BFinancial data is processed without being encrypted.
- CLogging is disabled on critical servers.
- DServer services have been virtualized and outsourced.
How the community answered
(25 responses)- A48% (12)
- B28% (7)
- C8% (2)
- D16% (4)
Why each option
Running unpatched, outdated Apache servers exposes the environment to publicly known exploits with available attack tools, making it the most immediately exploitable and significant risk. Encryption at rest and disabled logging are concerns, but they do not represent active attack surfaces the way unpatched software does.
Outdated, unpatched Apache versions have published CVEs with readily available proof-of-concept exploits. An attacker can systematically identify and compromise these servers remotely, potentially gaining access to all hosted data and infrastructure - this is an active, exploitable vulnerability unlike the other issues listed.
The scenario states financial data is encrypted when not in use (at rest), so this risk is already partially mitigated and is not the most significant threat.
Disabled logging impairs detection and forensic response but is not itself a vulnerability that allows an attacker to gain unauthorized access.
Virtualization and cloud outsourcing introduce shared-responsibility and isolation considerations, but they are architectural decisions rather than active technical vulnerabilities in this scenario.
Concept tested: Risk prioritization - unpatched software as critical vulnerability
Source: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=apache&search_type=all
Topics
Community Discussion
No community discussion yet for this question.