stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CCST Cybersecurity objective 4: Vulnerability Assessment and Risk Management Flashcards | StudBud
Explore
/
CCST Cybersecurity objective 4: Vulnerability Assessment and Risk Management
CCST Cybersecurity objective 4: Vulnerability Assessment and Risk Management
16 terms
·
StudBud Administration
·
27 plays
Imported from external platform
Flashcards
16 cards
F
Practice quiz
P
Host live
L
Questions
16
Answers
1
Which one is
NOT
a CVSS temporal metric?
Report Confidence
Attack Vector
Remediation Level
Exploit Code Maturity
2
Which one is
NOT
a CVSS environmental metric?
Integrity Requirement
Availability Requirement
Confidentiality Requirement
Report Confidence
3
What is the difference between a threat and a vulnerability?
A threat refers to natural disasters, whereas vulnerabilities are man-made.
A threat exploits a vulnerability, a vulnerability is a system weakness
A vulnerability is the intentional harm caused by a threat.
There is no difference; they are interchangeable terms.
4
Server Profile Elements
- the TCP and UDP daemons and ports that are normally open on a server
Listening ports
Logged in users and accounts
Service accounts
Software environment
5
Network Profile Elements
- the amount of data passing from source to destination in a given period of time:
Session duration
Total throughput
Critical asset address space
Ports used
6
Server Profile Elements
- the definitions of the type of service that an application is allowed to run
Logged in users and accounts
Service accounts
Listening ports
Software environment
7
Server Profile Elements
- the parameters defining user access and behavior
Software environment
Logged in users and accounts
Service accounts
Listening ports
8
Network Profile Elements
- the time between the establishment and termination of a data flow:
Ports used
Total throughput
Session duration
Critical asset address space
9
Network Profile Elements
- the IP addresses or logical location of essential systems or data:
Session duration
Total throughput
Critical asset address space
Ports used
10
Network Profile Elements
- a list of TCP or UDP processes that are available to accept data:
Session duration
Total throughput
Ports used
Critical asset address space
11
What are the three
CVSS
metric groups?
Complexity, Vector, and Remediation
Exploitability, Impact, and Environmental
Impact, Vector, and Exploitability
Base, Temporal, and Environmental
12
What is the first step in conducting a risk assessment?
Implementing security controls
Identifying and categorizing assets
Testing the security of the system
Creating a disaster recovery plan
13
Which of the following best describes a zero-day vulnerability?
A vulnerability discovered in an outdated system
A vulnerability that affects only specific users
A vulnerability that is actively being exploited without a known fix
A vulnerability that has been patched by the vendor
14
Server Profile Elements
- the tasks, processes, and applications that are permitted to run on the server
Listening ports
Logged in users and accounts
Software environment
Service accounts
15
What does the term “risk mitigation” mean in the context of cybersecurity?
Transferring risks to another entity, like an insurer
Ignoring low-priority risks to focus on severe threats
Reducing the impact or likelihood of a risk through controls
Avoiding all risks by shutting down the system
16
Which one is
NOT
a CVSS base metric?
Attack Vector
Attack Complexity
Privileges Required
Exploit Code Maturity
