Vulnerability Management CAS-005 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A vulnerability report lists a critical vulnerability on a web server. What is the most important information the report should include to help a system administrator remediate the issue?

   • AThe number of times the vulnerability was detected
   • BThe IP address of the attacker who exploited the vulnerability
   • CThe name of the vulnerability scanner vendor
   • DThe CVSS score and a description of the vulnerability
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After a vulnerability scan, a security analyst receives a report listing hundreds of vulnerabilities. The report includes CVSS scores, but the analyst needs to prioritize remediation efforts for the most critical vulnerabilities that are actively exploitable. Which approach should the analyst take?

   • ARemediate vulnerabilities in alphabetical order to ensure all are addressed.
   • BFocus on vulnerabilities that have a known exploit and are present on internet-facing systems.
   • CIgnore vulnerabilities with a CVSS score below 4.0 because they are not important.
   • DRemediate all vulnerabilities with a CVSS score of 7.0 or higher.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security analyst is tasked with identifying known security weaknesses in a corporate network. Which activity directly fulfills this requirement?

   • APerforming a penetration test
   • BConducting a security awareness training
   • CConducting a vulnerability scan
   • DReviewing firewall logs
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A vulnerability has a CVSS score of 9.8. How should this score be interpreted?

   • AThe score indicates the vulnerability is not exploitable
   • BThe vulnerability is highly severe and should be prioritized for remediation
   • CThe vulnerability is medium severity and should be addressed later
   • DThe vulnerability is low severity and can be ignored
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is writing an OVAL definition to check for a specific vulnerability. The analyst needs to ensure that the definition is accurate and will be interpreted correctly by different SCAP-validated tools. What should the analyst do?

   • AUse a unique identifier and follow the OVAL schema.
   • BTest the definition only on one type of system.
   • CWrite the definition in a proprietary format to ensure accuracy.
   • DAvoid using OVAL and use a custom script instead.
   Reveal Solution Discussion Select an answer first