Vulnerability Management CAS-005 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of Common Platform Enumeration (CPE) in vulnerability management?

   • ATo define machine-readable vulnerability tests
   • BTo format security checklists
   • CTo score the severity of vulnerabilities
   • DTo provide a standardized way to identify and name IT products and platforms
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the context of SCAP, what does an OVAL definition typically contain?

   • AA scoring formula for calculating risk
   • BA list of all known vulnerabilities in a database
   • CA human-readable description of a security policy
   • DA test that checks a system for a specific vulnerability or configuration issue
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A vulnerability scan report shows a high number of false positives. The security team is spending too much time investigating non-issues. The team wants to improve the accuracy of the scan results. Which action would be most effective?

   • AConfigure the scanner with credentials for authenticated scanning.
   • BIncrease the scan frequency to catch more vulnerabilities.
   • CUse a different scanner that is more expensive.
   • DManually verify every finding before reporting.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of a vulnerability report?

   • ATo automatically patch all identified vulnerabilities
   • BTo provide a legal defense against security incidents
   • CTo replace the need for penetration testing
   • DTo communicate findings to stakeholders for remediation decisions
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is reviewing a vulnerability report and sees a CVE identifier. The analyst wants to know if the vulnerability affects their specific software version. What is the most reliable way to determine this?

   • ACheck the CVSS score to determine if it is high enough to be relevant.
   • BRun a vulnerability scan to see if the system is vulnerable.
   • CLook up the CVE in the National Vulnerability Database (NVD).
   • DSearch the internet for the CVE number.
   Reveal Solution Discussion Select an answer first