Continuous Vulnerability Management GCCC Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   In the vulnerability management lifecycle, what is the primary purpose of the 'classify' step?

   • ATo determine the root cause of the vulnerability and fix the underlying code.
   • BTo assign a risk rating or priority to each identified vulnerability based on factors like severity and exploitability.
   • CTo verify that the vulnerability scanner is working correctly by comparing results to known benchmarks.
   • DTo automatically apply patches to all vulnerable systems without human intervention.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security team has completed a vulnerability assessment and found several critical vulnerabilities. Before beginning remediation, management wants to know which vulnerabilities are actually exploitable by an attacker. Which activity provides this information?

   • ARe-run the vulnerability scan with a different scanner.
   • BApply patches to all critical findings immediately.
   • CRun a penetration test to attempt exploitation of the critical findings.
   • DReview the CVSS scores and rank them by severity.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security team needs to scan a large enterprise network that includes both on-premises and cloud workloads. The team wants to minimize the risk of disrupting production systems while ensuring that all assets are covered. Which scanning strategy is most appropriate?

   • AUse only passive scanning to avoid any disruption.
   • BUse agent-based scanning for cloud workloads and schedule network scans for on-premises systems during maintenance windows.
   • CScan only critical assets to reduce the risk of disruption.
   • DRun all scans from a single central scanner during business hours.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A critical legacy application cannot be patched for a known remote code execution vulnerability because the vendor no longer provides updates. The application is only accessible internally by a small group of users. Which compensating control is most appropriate?

   • ADisable the application until a patch is available.
   • BRestrict network access to the application using firewall rules and require VPN for remote access.
   • CIncrease the CVSS score of the vulnerability to raise awareness.
   • DRun a vulnerability scan weekly and document the finding.
   Reveal Solution Discussion Select an answer first