Vulnerability Tracking CCOA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which factor is most important when prioritizing which vulnerabilities to remediate first?

   • AThe age of the vulnerability
   • BThe ease of patching the vulnerability
   • CThe risk posed by the vulnerability to critical assets
   • DThe number of vulnerabilities found on a single asset
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A critical vulnerability has been identified in a legacy application that is no longer supported by the vendor, and no patch is available. The application is essential for business operations and cannot be taken offline. The security team needs to mitigate the risk. Which action is the MOST appropriate compensating control?

   • AIncrease the logging level for the application and monitor for suspicious activity.
   • BDisable the application until a patch is developed internally.
   • CApply a configuration change to the application to disable the vulnerable feature.
   • DPlace the application behind a web application firewall (WAF) with rules to block known exploit patterns.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is performing a vulnerability assessment on a network that includes both Windows and Linux servers. The analyst runs an automated vulnerability scanner. The scanner reports a critical vulnerability on a Windows server, but the analyst suspects the scanner may have produced a false positive. What is the MOST appropriate step to verify the finding?

   • ARe-run the scanner with different credentials to see if the result changes.
   • BManually verify the vulnerability by checking the system's configuration and patch level.
   • CImmediately report the vulnerability as a confirmed critical issue to the system owner.
   • DIgnore the finding because the scanner is known to produce false positives.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does 'asset criticality' mean in the context of vulnerability prioritization?

   • AThe number of vulnerabilities present on the asset
   • BThe cost of the asset
   • CThe age of the asset
   • DThe importance of the asset to the organization's operations
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of vulnerability reporting to stakeholders?

   • ATo communicate findings and remediation status in a clear and actionable manner
   • BTo assign CVSS scores to vulnerabilities
   • CTo replace the need for vulnerability scanning
   • DTo automatically remediate vulnerabilities
   Reveal Solution Discussion Select an answer first