Continuous Vulnerability Management GCCC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team has a limited budget and must choose between running a full vulnerability assessment or a penetration test this quarter. The goal is to identify as many potential weaknesses as possible across the entire environment. Which should they choose?

   • ARun both in parallel to maximize coverage.
   • BRun a penetration test only on critical assets and skip the assessment.
   • CRun a penetration test because it provides more accurate results.
   • DRun a vulnerability assessment because it provides broad coverage of known vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst at a mid-sized company runs a quarterly authenticated vulnerability scan across all internal subnets. The scan report shows 2,400 findings, but the patch management team can only remediate about 200 per month. The analyst needs to focus the team's effort on the most urgent items. Which approach best aligns with risk-based prioritization?

   • ARemediate all critical-severity findings first, regardless of asset value or exposure.
   • BSort findings by CVSS base score and remediate the highest scores first.
   • CWait for the next scan to see which findings persist, then remediate only those.
   • DPrioritize findings that have a known exploit and are present on internet-facing systems, then use CVSS as a secondary tie-breaker.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which metric is most useful for tracking the effectiveness of a vulnerability management program over time?

   • APercentage of systems that have never been scanned.
   • BTotal number of vulnerabilities discovered in the first scan.
   • CNumber of vulnerability scanners deployed.
   • DMean time to remediate (MTTR) critical vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization has a critical vulnerability with a CVSS score of 9.8 on an internal application server. The server is not internet-facing, but it processes sensitive financial data. The exploit is publicly known and there are active exploits in the wild. The patch requires a reboot that will cause a 30-minute outage. The business wants to avoid the outage. What is the best course of action?

   • AImplement a compensating control, such as network segmentation or an application-layer firewall rule, and schedule the patch as soon as possible.
   • BApply the patch during the next scheduled maintenance window, even if it is two weeks away.
   • CPatch immediately during business hours and accept the outage.
   • DDo not patch because the server is not internet-facing.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice best supports the goal of continuous monitoring for new vulnerabilities?

   • AReviewing firewall logs on a monthly basis.
   • BConducting user awareness training annually.
   • CPerforming a comprehensive penetration test once a year.
   • DSubscribing to security advisories and integrating threat intelligence feeds into the scanning process.
   Reveal Solution Discussion Select an answer first