Vulnerability Tracking CCOA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a compensating control used to mitigate a vulnerability?

   • ADeleting the vulnerable application from the system
   • BUpgrading the operating system to a newer version
   • CApplying a software patch to fix the vulnerability
   • DImplementing a firewall rule to block access to the vulnerable service
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst at a financial firm runs a quarterly vulnerability scan. The scan reports a critical-severity SQL injection vulnerability (CVSS 9.8) in a legacy customer-facing web application that is scheduled for decommissioning in 60 days. The same scan also reports a high-severity (CVSS 7.5) remote code execution vulnerability in the company's internet-facing VPN gateway, which is used by all remote employees. The analyst has limited patching resources this quarter. Which vulnerability should be remediated FIRST?

   • AThe SQL injection in the legacy web application, because it has the highest CVSS score.
   • BBoth vulnerabilities simultaneously, because both are high severity and must be patched immediately.
   • CThe SQL injection in the legacy web application, because it is customer-facing and has a higher CVSS score than the VPN issue.
   • DThe remote code execution in the VPN gateway, because it is internet-facing, has a high CVSS score, and is critical to business operations.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to track the status of vulnerabilities over time?

   • ATo ensure that remediation efforts are completed and to provide audit evidence
   • BTo automatically patch vulnerabilities without human intervention
   • CTo eliminate the need for vulnerability scanning
   • DTo increase the severity score of vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is performing a vulnerability assessment on a new internal web application. The analyst wants to identify vulnerabilities that automated scanners might miss, such as business logic flaws and authentication issues. Which technique should the analyst use to supplement the automated scan?

   • ACheck the web server's configuration for insecure HTTP methods.
   • BReview the application's source code for hardcoded credentials.
   • CPerform a manual penetration test, focusing on the application's business logic and authentication flows.
   • DRun a network vulnerability scanner against the web application's host.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is tracking a vulnerability that was reported as 'Remediated' after a patch was applied. However, during a routine audit, the analyst discovers that the patch was not applied to all affected servers. One server was missed. What is the MOST appropriate action for the analyst to take?

   • AMark the vulnerability as 'False Positive' for the missed server because the patch was applied to other servers.
   • BReopen the vulnerability ticket for the missed server and document the discrepancy.
   • CClose the ticket because the patch was applied to the majority of servers.
   • DUpdate the ticket to 'In Progress' and note that the patch was applied to most servers.
   Reveal Solution Discussion Select an answer first