A Penetration Tester Has Identified Several Newly Released CVEs on a VoIP

question 51

Multiple Choice

A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?

• A) Manually check the version number of the VoIP service against the CVE release
• B) Test with proof-of-concept code from an exploit database
• C) Review SIP traffic from an on-path position to look for indicators of compromise
• D) Utilize an nmap -sV scan against the service Utilize an nmap -sV scan against the service

---

Definitions:

Occupational Safety

Practices and policies designed to protect workers from hazards and injuries in the workplace.

Water Spill

An accidental release of water into an unintended area, potentially causing damage or requiring clean-up efforts.

Occupational Safety and Health Administration

A federal agency responsible for enforcing safety and health legislation, part of the United States Department of Labor.

Occupational Safety and Health Review Commission

An independent federal agency created to adjudicate disputes arising from enforcement actions taken by the Occupational Safety and Health Administration (OSHA).