Vulnerability Identification CCOA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A vulnerability scan of a corporate network identified the following findings: (1) a critical remote code execution vulnerability in a legacy web server that is isolated from the internet and scheduled for decommissioning in two months; (2) a high-severity SQL injection flaw in a public-facing customer portal that has no known exploit in the wild; (3) a medium-severity misconfiguration on an internal file server that stores sensitive HR data. The analyst must prioritize remediation. Which vulnerability should be addressed first?

   • AThe SQL injection on the customer portal, because it is internet-facing and could be exploited by attackers.
   • BAll three equally, because every vulnerability must be fixed immediately.
   • CThe misconfiguration on the internal file server, because it stores sensitive HR data.
   • DThe critical RCE on the legacy web server, because of its CVSS score.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is building a vulnerability management program and needs a reliable source of vulnerability information to feed into the scanning and prioritization process. The analyst wants a standardized, publicly accessible database that assigns unique identifiers and severity scores. Which source should the analyst use?

   • AThe National Vulnerability Database (NVD)
   • BThe vendor's official security blog
   • CA threat intelligence feed from a commercial provider
   • DAn internal ticketing system
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A vulnerability scan identified a critical vulnerability in a database server that stores customer payment information. The vulnerability is not currently being exploited, but a proof-of-concept exploit has been published. The database server is internal and not directly accessible from the internet. The analyst must decide on a remediation priority. What should the analyst do?

   • AWait for the vendor to release a patch before taking any action.
   • BTreat it as low priority because the server is internal and not directly exposed.
   • CTreat it as high priority because of the sensitive data and the existence of a proof-of-concept exploit.
   • DImmediately disconnect the database server from the network.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is researching a newly disclosed vulnerability in a widely used application. The analyst needs to understand the technical details, the affected versions, and any available mitigations. Which source would provide the most authoritative and structured information?

   • AThe vendor's security advisory
   • BThe vulnerability scanner's internal database
   • CA social media post from a security researcher
   • DA random blog post from an unknown source
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a vendor advisory that provides vulnerability information?

   • AA company's internal incident response report
   • BA blog post by an independent security researcher
   • CA security bulletin published by a software vendor describing a flaw in its product
   • DA social media post from a cybersecurity influencer
   Reveal Solution Discussion Select an answer first