Vulnerability Tracking CCOA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a primary purpose of performing vulnerability scanning on an organization's assets?

   • ATo guarantee that no vulnerabilities exist after the scan completes
   • BTo replace the need for manual security assessments entirely
   • CTo automatically patch all identified vulnerabilities without human intervention
   • DTo identify and enumerate weaknesses that could be exploited by threats
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common way to classify the severity of a vulnerability?

   • ABy the number of users who have access to the affected asset
   • BBy the potential impact and exploitability of the vulnerability
   • CBy the vendor that produces the affected software
   • DBy the age of the vulnerability
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What type of information should be documented for each vulnerability in a tracking system?

   • AThe cost of the affected asset
   • BThe exact exploit code for the vulnerability
   • CThe vulnerability's status, remediation progress, and associated asset
   • DThe name of the security analyst who discovered it
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team has identified a vulnerability in a database that stores customer PII. The vulnerability has a CVSS score of 7.5. The team also identified a vulnerability in an internal file server with a CVSS score of 9.0. The file server does not contain sensitive data. The team has limited resources and can only remediate one vulnerability this week. Which vulnerability should be prioritized?

   • AThe file server vulnerability, because it has a higher CVSS score.
   • BThe database vulnerability, because it contains sensitive customer PII, which has a higher business impact.
   • CBoth vulnerabilities, because they are both serious and should be remediated immediately.
   • DThe file server vulnerability, because it is easier to exploit.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A vulnerability management analyst needs to report the status of remediation efforts to the Chief Information Security Officer (CISO). The CISO is interested in the overall risk reduction and the percentage of critical vulnerabilities that have been remediated. Which type of report would be MOST appropriate for this audience?

   • AA detailed technical report listing every vulnerability, its CVSS score, and the specific patch applied.
   • BA raw export of the vulnerability scanner's database for the CISO to analyze.
   • CA list of all open vulnerabilities with the names of the responsible system owners.
   • DA high-level executive summary with charts showing the number of critical vulnerabilities remediated over time and the overall risk score trend.
   Reveal Solution Discussion Select an answer first