Vulnerability Identification CCOA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst needs to identify vulnerabilities in a fleet of Windows servers that host a critical legacy application. The application is known to crash if certain system files are accessed during business hours. The analyst must minimize disruption while still obtaining detailed configuration and patch-level data. Which scanning approach should the analyst use?

   • ARun a web application scan against the legacy application's interface.
   • BRun a host-based scan with default credentials during business hours.
   • CRun an authenticated scan during off-peak hours.
   • DRun an unauthenticated network scan during business hours.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After completing a vulnerability scan, an analyst must report the findings to a mixed audience of IT administrators and senior management. The report should enable administrators to act quickly and help management understand the business risk. What is the most effective reporting approach?

   • AProvide a single detailed technical report with all scan data and CVSS scores.
   • BPublish the raw scan results on the internal wiki for anyone to access.
   • CCreate an executive summary highlighting risk levels and business impact, plus a technical appendix with detailed findings and remediation steps.
   • DSend a brief email listing only the critical vulnerabilities and their patch numbers.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of a network vulnerability scanner?

   • ATo analyze web application source code for security flaws
   • BTo identify open ports, services, and known vulnerabilities on networked devices
   • CTo enforce security policies on endpoints
   • DTo monitor network traffic for malicious activity in real time
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is exploitability an important factor in vulnerability prioritization?

   • AExploitability determines the cost of the vulnerability
   • BVulnerabilities with known exploits are more likely to be targeted by attackers
   • CExploitability is irrelevant to prioritization
   • DExploitability is the only factor that matters
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A vulnerability scan of a server reports a high-severity vulnerability in an outdated version of OpenSSL. The scan output includes the CVE identifier, the CVSS score, and the affected package version. The analyst needs to determine if the vulnerability is actually exploitable in the current environment. What additional information is most useful?

   • AThe services running on the server that use OpenSSL
   • BThe name of the vulnerability scanner
   • CThe operating system version
   • DThe IP address of the server
   Reveal Solution Discussion Select an answer first