Vulnerability Analysis and CVSS CEH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement best describes the role of vulnerability assessment in the ethical hacking methodology?

   • AIt is an optional step that can be skipped if the penetration test is time-constrained
   • BIt is the final phase that verifies whether all vulnerabilities have been patched
   • CIt is a passive activity that only reviews system configurations without any scanning
   • DIt is a preliminary step that identifies potential entry points and informs the exploitation phase
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An organization has two vulnerabilities to remediate: Vulnerability A has a CVSS base score of 9.0 but is only exploitable from the internal network with no known exploit. Vulnerability B has a CVSS base score of 6.5 but is internet-facing and has a public exploit. The team has limited resources. Which should be prioritized?

   • ABoth equally, because CVSS base scores are the only objective measure.
   • BVulnerability B, because it is internet-facing and has a public exploit, making it more likely to be attacked.
   • CNeither, because CVSS scores are not reliable for prioritization.
   • DVulnerability A, because its base score is higher and it is critical.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A vulnerability assessment report for a corporate network includes the following findings: (1) a buffer overflow in a legacy application, (2) an open SMB port on a file server, (3) a default password on a network printer, and (4) a lack of encryption on a wireless network. Which classification best describes these findings?

   • A1 is a host vulnerability; 2 is a network vulnerability; 3 is an application vulnerability; 4 is a configuration vulnerability
   • B1 and 2 are host vulnerabilities; 3 and 4 are network vulnerabilities
   • C1 is an application vulnerability; 2 is a network vulnerability; 3 and 4 are configuration vulnerabilities
   • DAll are network vulnerabilities because they affect the network infrastructure
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   During a penetration test, you discover two vulnerabilities: one with a CVSS score of 9.0 that affects an internet-facing web server, and another with a score of 6.5 that affects an internal legacy application. Based on CVSS prioritization, which vulnerability should be addressed first?

   • AThe 9.0 vulnerability because it has a higher CVSS score and is internet-facing
   • BThe 6.5 vulnerability because internal systems are more critical
   • CNeither should be addressed until a full risk assessment is completed
   • DBoth should be addressed simultaneously because they are equally important
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   According to the CVSS v3.1 severity rating scale, which qualitative rating corresponds to a base score of 7.5?

   • AMedium
   • BHigh
   • CLow
   • DCritical
   Reveal Solution Discussion Select an answer first