Continuous Vulnerability Management GCCC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of defining a scan scope before executing a vulnerability scan?

   • ATo decide which vulnerabilities to remediate first.
   • BTo determine the exact version of each vulnerability scanner to use.
   • CTo ensure that only authorized systems are scanned and to avoid unintended targets.
   • DTo allocate budget for purchasing scanning licenses.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A vulnerability scan reveals a critical vulnerability on a database server that is isolated on a private network segment with no internet access. The same vulnerability also appears on a web server in the DMZ. The patch for both is complex and requires a reboot. Which server should be patched first?

   • ANeither, because the patch is complex and risky.
   • BBoth at the same time, because they have the same vulnerability.
   • CThe web server, because it is exposed to the internet and more likely to be attacked.
   • DThe database server, because it stores sensitive data.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security manager wants to validate whether a recently patched web application is actually resistant to a specific known attack technique. The organization has a maintenance window next weekend. Which activity should be performed?

   • AExecute a targeted penetration test that attempts the known attack technique.
   • BCheck the web server logs for past exploitation attempts.
   • CRun an authenticated vulnerability scan against the application.
   • DReview the patch notes and mark the vulnerability as remediated.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team has completed a vulnerability scan that identified several high-severity findings. Management wants to know if these findings can actually be exploited by an attacker. The team has a limited budget and must choose between a full penetration test and a targeted exploit validation. Which approach is most appropriate?

   • APerform a targeted exploit validation on the high-severity findings.
   • BRun a full penetration test to cover all systems.
   • CRe-run the vulnerability scan with more credentials to get more detail.
   • DUse the CVSS scores to determine exploitability.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A critical application has a vulnerability that cannot be patched because the vendor has not released a fix. The application is internal but processes sensitive data. The security team has implemented a compensating control, but the vulnerability remains open in the scanner. What is the best way to handle this finding?

   • AMark the finding as a risk acceptance with a documented compensating control and a review date.
   • BIncrease the CVSS score to justify more resources.
   • CRemove the finding from the report to avoid confusion.
   • DKeep the finding open and do nothing else.
   Reveal Solution Discussion Select an answer first