Continuous Vulnerability Management GCCC Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What does the 'exploitability' component of a risk score typically indicate?

   • AThe financial cost to the organization if the vulnerability is exploited.
   • BThe time required to develop a patch for the vulnerability.
   • CThe number of systems that are affected by the vulnerability.
   • DHow easy it is for an attacker to successfully exploit the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team runs a quarterly authenticated vulnerability scan across all internal subnets. The scan report lists 1,200 findings. The team has limited patching staff and must reduce risk most effectively. Which approach should they take first?

   • AFocus only on findings that can be fixed with configuration changes, since patching is slow.
   • BPrioritize findings on internet-facing systems that have known exploited vulnerabilities and are critical assets.
   • CRemediate all findings on the first subnet scanned to ensure complete coverage.
   • DPatch all findings with a CVSS score of 9.0 or higher, regardless of asset criticality.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A vulnerability management team is trying to convince business leaders to fund additional patching resources. The team has data showing that the average time to remediate critical vulnerabilities is 45 days, but the industry benchmark is 15 days. Which metric would be most persuasive to justify the additional resources?

   • AThe average CVSS score of all open vulnerabilities.
   • BThe total number of vulnerabilities discovered in the last year.
   • CThe number of scans performed each month.
   • DThe percentage of critical vulnerabilities that were exploited before they could be patched.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A vulnerability management program has been running for a year. The team notices that the same vulnerabilities keep appearing in scans even after they are marked as fixed. Which step of the vulnerability management lifecycle is most likely being neglected?

   • AReporting
   • BIdentification
   • CContinuous monitoring and reassessment
   • DRemediation
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A vulnerability report shows that a low-CVSS vulnerability exists on a domain controller that also has a known exploit in the wild. The security team has limited resources. How should they treat this finding?

   • AReport it as a false positive without verification.
   • BDeprioritize it because the CVSS score is low.
   • CIgnore it until the next scheduled scan.
   • DPrioritize it because the asset is critical and the vulnerability is known to be exploited.
   Reveal Solution Discussion Select an answer first