Professional Documents
Culture Documents
VM Qualys Exam
VM Qualys Exam
(select two)
Choose an answer:
HEAD
OPTIONS
GET
POST
2. The __________ is a staging area for Web applications discovered by scans in the Qualys
Vulnerability Management (VM) application.
Choose an answer:
KnowledgeBase
Dashboard
Library
Catalog
3. What technique does WAS use to automate the detection of Web application vulnerabilities?
Choose an answer:
Hashing
Stack Fingerprinting
Fault Injection
Covert Channels
Choose an answer:
Web Applications
Option Profiles
Reports
Scan Results
Choose an answer:
Applications with a “malware” tag
Internal facing applications
External facing applications
Both internal and external facing applications
6. When launching a Web Application Scan, you have the option to override some default settings.
Which of the following options can NOT be overridden?
Choose an answer:
Option Profile
Crawl Scope (this might be right)
Scanner Appliance
Authentication Record
7. What attack proxies can you integrate with Qualys WAS?
Choose an answer:
BURP
W3af
ZAP
WebScarab
8. Which WAS feature will help you avoid scanning common links too many times?
Choose an answer:
Redundant Links
Malware Monitoring
Header Injection
DNS Override
10. What are your options for applications found in your Catalog? (select three)
Choose an answer:
Mark as Rogue
Mark as Scanned
Mark as Approved
Add to Subscription
11. Which Form Submission method will only test login forms?
Choose an answer:
NONE
POST & GET
GET
POST
Choose an answer:
Username/Password combinations
QIDs from the Qualys KnowledgeBase
Crawling hints
Common input parameters
13. Which technique can WAS use to bypass authentication?
Choose an answer:
Custom Authentication Record
Burp Integration
Selenium Authentication Script
Header Injection
14. Which WAS feature uses a virtual machine farm to detect a potentially malicious script in a
Web application?
Choose an answer:
Progressive Scanning
Malware Monitoring
Redundant Links
DNS Override
Choose an answer:
Blue
Red
Yellow
Green
16. If the Web application URL is http://demo06.qualys.com, which Crawl Scope should you select
in order to keep http://training.demo06.qualys.com in the application scope?
Choose an answer:
Limit to URL hostname and specified subdomain
Limit at or below URL hostname
Limit to URL hostname and specified domains
Limit to content located at or below URL subdirectory
17. Which of the following scanning challenges can be overcome using the WAS Progressive
Scanning feature? (select two)
Choose an answer:
Scanning a web application with hard-to-find links
Scanning a web application with tens of thousands of links
Scanning a web application with multiple IP addresses
Scanning a web application that would normally exceed the amount of time available within a limited
scanning window.
18. Which of the following Crawl Exclusion Lists can be generated using a WAS Application
Sitemap? (select two)
Choose an answer:
White List
Black List
Post Data Black List
Logout regular expression
19. What happens when you use the “Remove Web Assets” feature? (select two)
Choose an answer:
WAS purges (deletes) all of your application data for the removed application
A final web application scan is performed before purging the application
The application is removed from your WAS subscription
All application data is saved in the WAS catalog
Choose an answer:
Active
Re-opened
New
Fixed
Exploited
21. Using the "Crawling Hints" setting, WAS can crawl all links and directories found in: (select
two)
Choose an answer:
Index.html
Sitemap.xml
Robots.txt
default.css
22. A Search List can be used to customize a (Select all the apply):
Choose an answer:
Web Application Scan
Scan Report
Crawl Exclusions List
Web Application Report
23. If your application URL is: www.example.org/new/ , which of the of following links will be
crawled if the Crawl Scope is set to "Limit to content at or below URL subdirectory"? (select two)
Choose an answer:
www.example.org/existing
www.example.org
www.example.org/new/customers
www.example.org/new
24. Using the Administration Utility, which of the following scan permissions can be assigned to a
user role? (select three)
Choose an answer:
Cancel WAS Scan
Delete WAS Scan
Update WAS Scan
Launch WAS Scan
Choose an answer:
Red
Green
Blue
Yellow
26. Where can you “Ignore” a vulnerability for a Web Application? (select two)
Choose an answer:
Scorecard Report
Scan Report
Web Application Report
Detections Tab
27. What is the max number of hours a scan can continue on WAS before it times out?
Choose an answer:
16 hours
4 hours
24 hours
48 hours
Choose an answer:
Reports
BURP scans
Maps
Scans
29. Which WAS feature allows you to quickly change your Web Application’s resolved IP address?
Choose an answer:
Malware Monitoring
Progressive Scanning
Redundant Links
DNS Override
30. How can you get your scan to follow a business workflow (such as a shopping cart
transaction)?
Choose an answer:
Use a Selenium Script to record and replay the workflow
Use a Custom Authentication Record
Use a Crawl Exclusion List
Hi Friends,
In this post, I will share the complete exam guide for Qualys Guard Policy
Compliance you just need to follow the guide to pass this exam all answers are verified.
3. Which of the following user-defined controls (UDCs) can *only* be used with
a Unix host?
Choose an answer:
Registry Value Content Check
File Content Check
File Integrity Check
WMI Query Check
Choose an answer:
Auditor
Manager
Reader
Scanner
6. Which of the following user-defined controls (UDCs) can *only* be used with
a Windows host? (choose two)
Choose an answer:
WMI Query Check
File Integrity Check
File Content Check
Registry Value Content Check
11. What type of report allows you to request an exception for a failed policy
control?
Choose an answer:
Interactive Report
Policy Report
Authentication Report
Scorecard Report
13. The Auditor role can perform the following tasks within the Policy
Compliance application: (Choose three)
Choose an answer:
Run compliance scans
Handle exception requests
Create reports
Edit policies
14. When launching a compliance scan, you must select a: (choose two)
Choose an answer:
Policy name
Scan target
Search List
Compliance Profile
16. What policy creation method requires at least one successful compliance
scan?
Choose an answer:
Existing Host
Empty Policy
XML File
Policy Library
17. What is the appropriate cardinality for a control that defines a "Prohibited
Software" list?
Choose an answer:
Matches
Does Not Contain
Contains
Intersects
18. What policy creation method allows you to use a locked policy which has
been reviewed and certified?
Choose an answer:
XML File
Empty Policy
Existing Host
Policy Library
19. Which of the following options are available for creating a policy in Qualys
Policy Compliance? (Choose three)
Choose an answer:
Create a policy from an existing host
Create from Scratch
Import one from the Qualys Library
Import policy from a CSV file
20. Which user-defined control (UDC) can be used to enumerate the list of
running processes on a Windows host?
Choose an answer:
WMI Query Check
File Integrity Check
Registry Value Content Check
File Content Check
21. Which user-defined control (UDC) will allow you to check the status of the
'PermitRootLogin' setting, on a Unix host?
Choose an answer:
Registry Value Content Check
File Content Check
File Integrity Check
WMI Query Check
22. A Qualys Compliance Scan collects host ‘data points’ which serve as the __________ values
for each control test.
Choose an answer:
Approximate
Actual
Relative
Expected
23. If you want to scan an Apache Web Server (running on a Unix host), which
of the following authentication records will you need to create?
Choose an answer:
Apache authentication
Windows authentication
Unix authentication
Both Apache and Unix authentication
25. All user defined controls (UDCs) are numbered __________ and greater.
Choose an answer:
100
1000
10000
100000
26. Which user roles require extended privileges to access the Policy
Compliance application? (choose two)
Choose an answer:
Auditor
Scanner
Manager
Reader
27. What type of report provides summary statistics that allow you to
compare multiple policies, side-by-side?
Choose an answer:
Interactive Report
Scorecard Report
Policy Report
Authentication Report
28. Which of the following tests can be performed only when the Dissolvable Agent is enabled?
(choose three)
Choose an answer:
Windows Directory Search
Windows Share Enumeration
Password Auditing
WMI Query Check
Qualysguard is one of the known vulnerability management tool that is used to scan the technical
vulnerabilities. I am sharing this exam guide that will help you to pass Vulnerability Management (VM)
exam. You will earn Qualys Certified Specialist certificate once you passed the exam. all questions and
answers are verified and recently updated.
Asset Groups
Domain Name
IP addressing
Asset Tags
Search Lists
MAC Address
Offline Scanner
Virtual Scanner
External Scanner
Internal Scanner
Host Discovery
OS Detection
Port Scanning
Business Impact
Share Enumeration
Scan Dead Hosts
Authentication
Authoritative Option
6. What is the maximum number of TCP ports that can
participate in the Host Discovery process?
Choose an answer:
10
65535
1900
20
Business Impact
Security Risk
CVSS Base
CVE ID
Authentication Record
Search List
Asset Map
Report Template
QIDs
Host Assets
Applications
Asset Groups
Run a scan
Create a remediation policy
Run a report
Search the KnowledgeBase
Asset Searches
Updates to the KnowledgeBase
Maps
Reports
Scans
Target Hosts
Option Profile
Authentication Record
Scanner Appliance
15. About how many services can Qualys detect via the
Service Detection Module?
Choose an answer:
13
512
20
600
Auditor
Administrator
Reader
Scanner
Unit Manager
All
Unix
Windows
None
20. About how many TCP ports are scanned when using
Standard Scan option?
Choose an answer:
1900
10
20
65535
Reports
Vulnerability Scans
Remediation Policies
Search Lists
Host IP
Option Profile Settings
Potential Vulnerabilities
Information Gathered
Vulnerabilities
27. Which of the following types of items can be found in
the Qualys KnowledgeBase? (choose all that apply)
Choose an answer:
Potential Vulnerabilities
Configuration data (Information Gathered)
Confirmed Vulnerabilities
Asset Groups
Remediation Tickets
Authentication Records
Report Templates
Remediation Policies
Option Profiles
29. What type of Search List adds new QIDs to the list
when the Qualys KnowledgeBase is updated?
Choose an answer:
Active
Static
Dynamic
Passive
Ranked
Purged
Ignored
Archived