GCIH · Question #38
You work as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company wants to fix potential vulnerabilities existing on the tested systems. You use Nessus as…
The correct answer is A. Misconfiguration (e.g. open mail relay, missing patches, etc.) B. Vulnerabilities that allow a remote cracker to control sensitive data on a system C. Vulnerabilities that allow a remote cracker to access sensitive data on a system. Nessus detects misconfigurations, remote access vulnerabilities, and remote control vulnerabilities, but does not specifically scan for code injection attack vectors. The question tests understanding of Nessus scanner capabilities and limitations.
Question
You work as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company wants to fix potential vulnerabilities existing on the tested systems. You use Nessus as a vulnerability scanning program to fix the vulnerabilities. Which of the following vulnerabilities can be fixed using Nessus? Each correct answer represents a complete solution. Choose all that apply.
Options
- AMisconfiguration (e.g. open mail relay, missing patches, etc.)
- BVulnerabilities that allow a remote cracker to control sensitive data on a system
- CVulnerabilities that allow a remote cracker to access sensitive data on a system
- DVulnerabilities that help in Code injection attacks
How the community answered
(37 responses)- A92% (34)
- D8% (3)
Why each option
Nessus detects misconfigurations, remote access vulnerabilities, and remote control vulnerabilities, but does not specifically scan for code injection attack vectors. The question tests understanding of Nessus scanner capabilities and limitations.
Nessus identifies misconfigurations such as open mail relays, missing patches, and default credentials, which are core capabilities of the scanner.
Nessus detects vulnerabilities that could allow a remote attacker to gain control over a system, such as unpatched RCE flaws, as part of its plugin-based scanning framework.
Nessus identifies vulnerabilities that expose sensitive data to unauthorized remote access, including weak authentication and unencrypted services, making this a valid detection category.
Nessus does not specifically target or remediate code injection attack vulnerabilities such as SQL injection or command injection as a defined scanning category, placing this outside the described scope of its core capabilities.
Concept tested: Nessus vulnerability scanner capabilities and scope
Source: https://docs.tenable.com/nessus/Content/NessusOverview.htm
Topics
Community Discussion
No community discussion yet for this question.