Vulnerability Assessment CCOA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When analyzing vulnerability scan results, which factor is most important for prioritizing which vulnerability to remediate first?

   • AThe number of characters in the vulnerability description
   • BThe severity score and the likelihood of exploitation
   • CThe date the vulnerability was first discovered
   • DThe alphabetical order of the vulnerability name
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following should be included in a vulnerability assessment report to effectively communicate risk to management?

   • AOnly the vulnerabilities that were successfully exploited
   • BRaw scan logs without interpretation
   • CExecutive summary with risk ratings and recommended actions
   • DA list of all employee usernames and passwords
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is reviewing scan results and finds a critical vulnerability in a public-facing web server. The vulnerability is rated CVSS 9.8, but the analyst notes that the exploit requires authentication and the server is behind a WAF that filters the attack. The analyst must decide whether to remediate immediately or schedule it for the next maintenance window. What should the analyst do?

   • ARemediate immediately because the CVSS score is critical
   • BSchedule remediation for the next maintenance window, but monitor for active exploitation in the meantime
   • CIgnore the vulnerability because the WAF mitigates it
   • DDisable the web server until the vulnerability is patched
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After completing a vulnerability assessment, an analyst must communicate the findings to different stakeholders. The executive team needs a high-level summary of risk, while the IT operations team needs detailed technical information. What should the analyst do?

   • AOnly report the critical vulnerabilities to the executive team
   • BSend the same detailed technical report to all stakeholders
   • CVerbally brief the executive team and provide no written documentation
   • DCreate a tailored report for each audience, highlighting risk for executives and technical details for IT operations
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a common automated method for identifying vulnerabilities in network services?

   • AConducting a manual code review of the application
   • BReviewing firewall logs for past intrusions
   • CInterviewing system administrators about security practices
   • DUsing a vulnerability scanner to probe open ports and service versions
   Reveal Solution Discussion Select an answer first