Vulnerability Identification CCOA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A vulnerability scan identified a critical vulnerability in a widely used software product. The CVE has a CVSS score of 9.8, but the vendor has not yet released a patch. Threat intelligence feeds indicate that the vulnerability is being actively exploited in the wild, but only against a specific configuration that is not present in the organization's environment. The affected system is a non-critical internal file server. What should the analyst do?

   • AApply interim mitigations recommended by the vendor and monitor threat intelligence for changes.
   • BWait for the vendor patch and do nothing else.
   • CImmediately isolate the file server from the network.
   • DIgnore the vulnerability because the organization's configuration is not affected.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to scan its internal network for vulnerabilities without providing credentials to the scanning tool. The goal is to identify externally visible weaknesses that an unauthenticated attacker could exploit. Which scanning approach is best suited for this objective?

   • AUnauthenticated scan
   • BHost-based scan with default credentials
   • CAuthenticated scan
   • DWeb application scan
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   After a vulnerability scan, the analyst needs to document the findings for the IT team. The documentation should include enough detail for the team to understand the vulnerability and take action. What is the most important element to include in the documentation?

   • AThe name of the vulnerability scanner used
   • BThe date and time of the scan
   • CThe exact CVSS score for each vulnerability
   • DThe affected asset, the vulnerability description, and recommended remediation steps
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When communicating vulnerability findings to non-technical stakeholders, what is the most effective approach?

   • AProvide raw scan logs with technical details
   • BUse business-oriented language that explains the risk and impact in terms of business operations
   • CAvoid mentioning vulnerabilities to prevent alarm
   • DOnly share the number of vulnerabilities found
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A vulnerability scan report shows that a critical vulnerability (CVE-2024-1234) is present on 50 servers. However, the analyst notices that the scan was performed using unauthenticated checks. The affected servers are a mix of internet-facing web servers and internal database servers. The analyst must decide how to proceed. What is the most appropriate action?

   • APerform an authenticated scan on a sample of the affected servers to validate the findings before widespread remediation.
   • BTreat all 50 servers as confirmed vulnerable and prioritize remediation based on the CVSS score.
   • CIgnore the finding because unauthenticated scans are never reliable.
   • DImmediately patch all internet-facing servers and defer the internal database servers.
   Reveal Solution Discussion Select an answer first