A security team is planning a vulnerability assessment for a new web application before it goes live. The team wants to identify weaknesses in the application's code, configuration, and dependencies. Which approach best aligns with the purpose of a vulnerability assessment in this context?

Perform a penetration test that exploits vulnerabilities to determine the actual impact

Run automated vulnerability scanners and manual code review to identify potential weaknesses

Review the application's firewall rules and network segmentation only

Wait until after deployment and monitor logs for suspicious activity

Which database provides a public catalog of common identifiers for publicly known cybersecurity vulnerabilities and is maintained by the MITRE Corporation?

CVE (Common Vulnerabilities and Exposures)

NVD (National Vulnerability Database)

CWE (Common Weakness Enumeration)

CAPEC (Common Attack Pattern Enumeration and Classification)

EC-CouncilCertified Ethical Hacker

Domain 3Objective 1

Vulnerability Analysis and CVSS CEH Practice Questions (Page 5)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 21–25

21application · medium
A security team is planning a vulnerability assessment for a new web application before it goes live. The team wants to identify weaknesses in the application's code, configuration, and dependencies. Which approach best aligns with the purpose of a vulnerability assessment in this context?
Select an answer first
22foundation · easy
Which database provides a public catalog of common identifiers for publicly known cybersecurity vulnerabilities and is maintained by the MITRE Corporation?
Select an answer first
23foundation · easy
Which component of the CVSS metric group reflects characteristics of the vulnerability that are constant over time and across user environments?
Select an answer first
24application · easy
A vulnerability has a CVSS v3.1 base score of 6.5. According to the standard qualitative severity rating scale, how should this be classified?
Select an answer first
25foundation · easy
Which vulnerability database is operated by the U.S. National Institute of Standards and Technology (NIST) and provides CVSS scores for CVE entries?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Vulnerability Analysis and CVSS CEH Practice Questions (Page 5)

Questions 21–25

A security team is planning a vulnerability assessment for a new web application before it goes live. The team wants to identify weaknesses in the application's code, configuration, and dependencies. Which approach best aligns with the purpose of a vulnerability assessment in this context?

Which database provides a public catalog of common identifiers for publicly known cybersecurity vulnerabilities and is maintained by the MITRE Corporation?

Which component of the CVSS metric group reflects characteristics of the vulnerability that are constant over time and across user environments?

A vulnerability has a CVSS v3.1 base score of 6.5. According to the standard qualitative severity rating scale, how should this be classified?

Which vulnerability database is operated by the U.S. National Institute of Standards and Technology (NIST) and provides CVSS scores for CVE entries?

Keep studying — System Hacking Phases and Attack Techniques