Vulnerability Assessment CCOA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of a vulnerability assessment report?

   • ATo provide a list of all employees' passwords
   • BTo communicate findings and remediation status to stakeholders
   • CTo serve as a marketing document for the security team
   • DTo replace the need for incident response plans
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst has completed a vulnerability assessment and needs to document the findings. Which information should be included in the vulnerability report to provide a complete picture for stakeholders?

   • AA list of all software versions installed on the network
   • BOnly the list of vulnerabilities and their CVSS scores
   • CThe names of the analysts who performed the scan
   • DA detailed description of each vulnerability, affected systems, potential impact, and recommended remediation
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A vulnerability scan of a corporate network reports the following findings: a critical remote code execution vulnerability in a legacy application that is not exposed to the internet, a high-severity SQL injection in an internal HR portal, and a medium-severity missing security patch on a public-facing web server. The analyst has limited resources and must prioritize remediation. Which vulnerability should be addressed first?

   • AAll three should be remediated simultaneously
   • BThe high-severity SQL injection in the internal HR portal
   • CThe critical RCE in the legacy application
   • DThe medium-severity missing patch on the public-facing web server
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement best describes the primary purpose of a vulnerability assessment in the cybersecurity operations lifecycle?

   • ATo replace the need for continuous monitoring and patch management
   • BTo identify, classify, and prioritize security weaknesses in systems and applications
   • CTo remove all security controls to test system resilience
   • DTo actively exploit identified weaknesses to prove impact
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team wants to perform a vulnerability scan of their internal network. They are concerned about the impact of the scan on production systems. Which scanning approach would minimize the risk of disrupting critical services?

   • APerform an authenticated scan during off-peak hours
   • BPerform a full scan with all plugins enabled during off-peak hours
   • CPerform a non-intrusive scan that only checks for open ports and service versions
   • DPerform an unauthenticated scan during business hours
   Reveal Solution Discussion Select an answer first