Continuous Vulnerability Management GCCC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company has a vulnerability management program that scans quarterly, but new critical vulnerabilities are often discovered between scans. The security team wants to reduce the window of exposure. Which change is most effective?

   • ASwitch from authenticated to unauthenticated scans to run faster.
   • BIncrease scan frequency to weekly and use threat intelligence to trigger ad-hoc scans for new critical vulnerabilities.
   • CKeep quarterly scans but extend the scan window to cover more subnets.
   • DRely on vendor advisories and manually check systems.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A vulnerability management team needs to report progress to executives who want to see whether the organization is reducing risk over time. Which metric is most meaningful for this purpose?

   • ANumber of scans performed each month.
   • BAverage CVSS score of all open findings.
   • CTotal number of vulnerabilities discovered in the last scan.
   • DPercentage of critical vulnerabilities remediated within the SLA window.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which factor is most important when prioritizing vulnerabilities for remediation?

   • AThe likelihood of exploitation and the potential impact on the business.
   • BThe CVSS base score alone.
   • CThe number of systems affected, regardless of their importance.
   • DThe age of the vulnerability since it was first disclosed.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team needs to scan a mix of cloud-hosted virtual machines and on-premises servers. The cloud VMs are ephemeral and can be terminated at any time. The team wants to ensure that all VMs are scanned at least once before they are terminated. Which approach is most reliable?

   • ASchedule a nightly active scan of the cloud VMs' IP addresses.
   • BScan only the on-premises servers because cloud VMs are less critical.
   • CUse passive monitoring to capture cloud VM traffic.
   • DUse a cloud-native scanning integration that triggers a scan when a new VM is provisioned.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which activity is characteristic of a penetration test but NOT of a typical vulnerability assessment?

   • AScanning the network to discover open ports and services.
   • BIdentifying the presence of known vulnerabilities using automated scanners.
   • CAttempting to exploit identified vulnerabilities to gain unauthorized access.
   • DProviding a list of vulnerabilities with severity ratings.
   Reveal Solution Discussion Select an answer first