Done June 11 - 180 - Vulnerability management L -5 to 7

Question 1

Which type of vulnerability scan provides insight into vulnerabilities discoverable to non-authenticated users?

Accepted Answer

Noncredentialed scan

Question 2

What factor might justify lowering a CVSS score for a remote code execution vulnerability?

Accepted Answer

System is air-gapped

Question 3

Which CVSS score range indicates a "Critical" vulnerability?

Accepted Answer

9.0–10.0

Question 4

Which vulnerability scanning tool is mentioned as a general-purpose scanner?

Accepted Answer

Nessus

Question 5

What describes a vulnerability scan incorrectly indicating a vulnerability is present?

Accepted Answer

False positive

Question 6

Which OWASP Top 10 vulnerability involves exploiting unvalidated input to manipulate a system e.g. altering DB queries?

Accepted Answer

Injection

Question 7

What type of scanning involves inspecting traffic flows and protocols without direct interaction?

Accepted Answer

Passive scanning

Question 8

What is the purpose of a configuration baseline in vulnerability management?

Accepted Answer

To measure endpoint security settings

Question 9

What is the purpose of the Security Content Automation Protocol (SCAP)?

Accepted Answer

To standardize identification of software flaws and vulnerabilities

Question 10

What is the purpose of fuzzing in vulnerability analysis?

Accepted Answer

To inject malformed data to identify vulnerabilities

Question 11

What is a common inhibitor to vulnerability remediation?

Accepted Answer

Legacy systems

Question 12

Which action plan outcome focuses on applying updates to software vulnerabilities?

Accepted Answer

Software patching

Question 13

Which SCAP language is used to standardize benchmarks definitions and security checks?

Accepted Answer

Extensible Configuration Checklist Description Format (XCCDF)

Question 14

Which CVSS metric indicates whether user interaction is required to exploit a vulnerability?

Accepted Answer

User Interaction (UI)

Question 15

What is a challenge of using KPIs in cybersecurity?

Accepted Answer

Incidents can be subjective

Question 16

What is the name of the document demonstrating PCI DSS compliance?

Accepted Answer

Attestation of Compliance (AoC)

Question 17

Which privacy regulation applies to organizations collecting data from EU entities?

Accepted Answer

GDPR

Question 18

What dashboards provide a live view of critical data with graphs, charts, and status indicators?

Accepted Answer

Vulnerability management dashboard

Question 19

What does PCI DSS stand for?

Accepted Answer

Payment Card Industry Data Security Standard

Question 20

Which organization publishes the Top 10 web application security risks?

Accepted Answer

OWASP

Question 21

Which KPI measures how incident response efforts are improving by comparing to industry averages?

Accepted Answer

Detection time

Question 22

Which regulatory compliance report includes information on employee training records?

Accepted Answer

Regulatory compliance report

Question 23

Which type of industrial system requires special care due to exploitable vulnerabilities?

Accepted Answer

Operational Technology (OT)

Question 24

What is the primary benefit of vulnerability management reporting?

Accepted Answer

Increasing awareness of IT infrastructure risks

Question 25

What does CVE stand for in the context of SCAP?

Accepted Answer

Common Vulnerabilities and Exposures

Question 26

Which report format is best for visually appealing presentations in browsers?

Accepted Answer

HTML

Done June 11 - 180 - Vulnerability management L -5 to 7

Questions 26

Done June 11 - 180 - Vulnerability management L -5 to 7

Questions 26