Vulnerability Tracking CCOA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key characteristic of an effective vulnerability report?

   • AIt includes technical jargon without explanation
   • BIt focuses only on vulnerabilities that have been patched
   • CIt lists every vulnerability without prioritization
   • DIt provides clear, actionable information tailored to the audience
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is tasked with identifying vulnerabilities in a new internal application before it is deployed. The analyst wants to ensure that the application is free from common coding flaws like SQL injection and cross-site scripting (XSS). Which assessment technique is MOST appropriate for this task?

   • APerform a static application security testing (SAST) review of the source code.
   • BRun a network vulnerability scanner against the application's server.
   • CConduct a penetration test on the running application.
   • DReview the application's configuration files for default credentials.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team has identified a critical vulnerability in a custom-built application. The vendor has released a patch, but the patch is known to cause a minor performance degradation in the application. The application is business-critical and has a strict uptime requirement. The team must decide how to proceed. What is the BEST course of action?

   • AApply the patch immediately, as the security risk outweighs the performance impact.
   • BImplement a compensating control, such as a WAF rule, and do not apply the patch.
   • CDo not apply the patch and accept the risk, as the performance impact is unacceptable.
   • DApply the patch in a staging environment, test the performance impact, and if acceptable, schedule the patch for the next maintenance window.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of the Common Vulnerability Scoring System (CVSS)?

   • ATo identify the exact exploit code for a vulnerability
   • BTo provide a standardized method for scoring the severity of vulnerabilities
   • CTo replace the need for manual risk assessment
   • DTo automatically patch vulnerabilities based on their score
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A vulnerability management team needs to report to both the technical team and the executive leadership. The technical team needs a list of specific vulnerabilities, their CVSS scores, and the affected systems. The executive leadership needs a summary of the overall risk posture and the progress of remediation efforts. What is the MOST effective reporting strategy?

   • ACreate two separate reports: one detailed technical report for the technical team and one high-level executive summary for the leadership.
   • BCreate a high-level executive summary for both the technical team and the executive leadership.
   • CSend the same detailed technical report to both the technical team and the executive leadership.
   • DCreate a single detailed report that includes all technical details and a high-level summary at the beginning.
   Reveal Solution Discussion Select an answer first