CySA+ Attack Surface Management Techniques Quiz

1. True or False: API endpoints do not contribute significantly to an organization's attack surface.

True

False

Submit

3. Which stakeholder group is most responsible for prioritizing attack surface remediation efforts?

Risk management and security leadership in collaboration with business units

IT help desk only

Individual system administrators without coordination

External auditors exclusively

Submit

5. Which approach best addresses continuous attack surface management?

Implementing automated scanning and periodic reassessments of assets and configurations

Conducting assessments once annually

Relying solely on vulnerability reports from vendors

Performing manual reviews only when incidents occur

6. True or False: Third-party and supply chain assets are typically excluded from attack surface assessments.

True

False

7. What is the primary purpose of threat modeling in attack surface management?

Understanding potential attack paths and prioritizing defensive measures

Predicting the exact date of the next breach

Determining attacker motivations exclusively

Establishing insurance premium rates

Submit

9. Which control type is most effective for minimizing attack surface exposure?

Preventive controls that disable unnecessary services and harden systems

Detective controls only

Corrective controls exclusively

Compensating controls without other measures

10. What is the relationship between vulnerability management and attack surface management?

Attack surface management identifies exposure points; vulnerability management assesses and remediates weaknesses

They are completely separate and unrelated disciplines

Vulnerability management is only for patch management

Attack surface management replaces the need for vulnerability scanning

11. Which of the following best describes attack surface management?

Identifying and inventorying all assets and potential entry points exposed to attackers

Installing firewalls on all network perimeters

Monitoring only internal network traffic

Encrypting all data at rest and in transit

12. Which of the following best represents an internal attack surface consideration?

Unpatched systems and weak access controls within the organization

Only threats originating from the internet

Customer complaints about service availability

Competitor market positioning

Submit

14. Which tool category is commonly used for passive reconnaissance during attack surface mapping?

DNS enumeration and WHOIS lookups

Penetration testing frameworks with active exploitation

Antivirus software

Email filtering systems

15. What is a primary benefit of conducting regular attack surface assessments?

Detecting emerging threats and new exposure points before attackers do

Guaranteeing zero security incidents

Eliminating the need for incident response plans

Reducing software licensing costs

16. True or False: Reducing attack surface always requires eliminating all non-essential services.

True

False

17. Which of the following is a key component of external attack surface analysis?

Scanning internet-facing services and public-facing applications

Only testing internal network segmentation

Reviewing employee badge access logs

Analyzing physical security camera footage

18. What does CVSS score help security teams accomplish?

Prioritize vulnerabilities by severity and exploitability

Determine the exact cost of a breach

Identify the attacker's identity

Calculate network bandwidth usage

19. Which technique is most effective for identifying shadow IT and unauthorized cloud services?

Network traffic analysis and DNS monitoring

Manual user interviews only

Reviewing purchase orders exclusively

Checking email metadata

20. What is the primary goal of asset discovery in attack surface management?

To identify all hardware and software components within the organization's environment

To remove deprecated systems from inventory

To establish network bandwidth requirements

To assign hardware depreciation values

CySA+ Attack Surface Management Techniques Quiz

1. True or False: API endpoints do not contribute significantly to an organization's attack surface.

2.

What first name or nickname would you like us to use?

2. Implementing network segmentation and access controls are examples of ______ strategies in attack surface reduction.

3. Which stakeholder group is most responsible for prioritizing attack surface remediation efforts?

4. Reducing unnecessary network ______ and services directly decreases attack surface exposure.

5. Which approach best addresses continuous attack surface management?

6. True or False: Third-party and supply chain assets are typically excluded from attack surface assessments.

7. What is the primary purpose of threat modeling in attack surface management?

8. Default credentials and open ports are examples of ______ risks in attack surface management.

9. Which control type is most effective for minimizing attack surface exposure?

10. What is the relationship between vulnerability management and attack surface management?

11. Which of the following best describes attack surface management?

12. Which of the following best represents an internal attack surface consideration?

13. The practice of identifying and managing ______ is critical to reducing organizational risk.

14. Which tool category is commonly used for passive reconnaissance during attack surface mapping?

15. What is a primary benefit of conducting regular attack surface assessments?

16. True or False: Reducing attack surface always requires eliminating all non-essential services.

17. Which of the following is a key component of external attack surface analysis?

18. What does CVSS score help security teams accomplish?

19. Which technique is most effective for identifying shadow IT and unauthorized cloud services?

20. What is the primary goal of asset discovery in attack surface management?