Vulnerability Tracking CCOA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team has identified two vulnerabilities. The first is a critical (CVSS 9.8) vulnerability in an internal development server that is not accessible from the internet. The second is a high (CVSS 7.5) vulnerability in an internet-facing web server that handles customer transactions. The team has limited resources and can only remediate one this week. Which vulnerability should be prioritized?

   • ABoth vulnerabilities, because they are both serious and should be remediated immediately.
   • BThe critical vulnerability in the internal development server, because it is easier to exploit.
   • CThe critical vulnerability in the internal development server, because it has a higher CVSS score.
   • DThe high vulnerability in the internet-facing web server, because it is exposed to the internet and handles customer transactions.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the main purpose of classifying vulnerabilities by type, severity, and affected asset?

   • ATo satisfy all regulatory compliance requirements
   • BTo automatically remediate all vulnerabilities
   • CTo eliminate the need for vulnerability scanning
   • DTo prioritize remediation efforts effectively
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the goal of vulnerability remediation?

   • ATo identify all vulnerabilities in the environment
   • BTo assign severity scores to vulnerabilities
   • CTo eliminate or reduce the risk posed by vulnerabilities
   • DTo document vulnerabilities for compliance purposes
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is reviewing a vulnerability report. A vulnerability in a public-facing web server has a CVSS v3.1 base score of 9.8. However, the analyst notes that the exploit requires the attacker to be on the same network segment as the server, and the server is not accessible from the internet. The analyst also knows that the server contains non-sensitive public information. How should the analyst use the CVSS score in the risk assessment?

   • AUse the base score of 9.8 but add a note that the actual risk is lower due to the environmental factors.
   • BUse the base score of 9.8 as the final risk rating, since it is the standard measure of severity.
   • CIgnore the CVSS score and rely solely on the analyst's judgment of the risk.
   • DAdjust the CVSS score using environmental metrics to reflect the lower attack vector and the low impact on confidentiality.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a manual assessment technique used to identify vulnerabilities?

   • AMonitoring network traffic for anomalies in real time
   • BRunning an automated vulnerability scanner against a network
   • CDeploying a firewall to block malicious traffic
   • DReviewing system configuration files for insecure settings
   Reveal Solution Discussion Select an answer first