CCD Vulnerability Assessment & Management 2 — Questions and Answers
Question 1: Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for the vulnerability to be exploited?
- Attack Vector
- Attack Complexity (Correct answer)
- Privileges Required
- User Interaction
Correct answer: Attack Complexity
Attack Complexity (AC) captures conditions outside attacker control, such as race conditions or specific configuration states.
Question 2: A vulnerability scanner reports a finding with CVSS score 9.8. Which risk category does this fall under?
- Medium
- High
- Critical (Correct answer)
- Low
Correct answer: Critical
CVSS scores 9.0–10.0 are classified as Critical severity.
Question 3: What is the primary purpose of a vulnerability disclosure policy (VDP)?
- Eliminate all vulnerabilities before public release
- Provide a structured channel for external researchers to report flaws safely (Correct answer)
- Automate patch deployment to production systems
- Restrict security researchers from testing company assets
Correct answer: Provide a structured channel for external researchers to report flaws safely
A VDP establishes rules of engagement and a safe reporting channel for external security researchers.
Question 4: Which technique allows a vulnerability scanner to obtain more accurate results by using system credentials?
- Passive scanning
- Unauthenticated scanning
- Credentialed scanning (Correct answer)
- Fuzzing
Correct answer: Credentialed scanning
Credentialed (authenticated) scanning logs into the target to inspect installed software, registry, and configuration directly.
Question 5: An organization receives a vendor patch but cannot apply it immediately due to operational constraints. Which compensating control is MOST appropriate for a critical network service vulnerability?
- Disable the service permanently
- Apply a WAF rule or network ACL to block exploit traffic (Correct answer)
- Delete the vulnerable software
- Perform a full system rebuild
Correct answer: Apply a WAF rule or network ACL to block exploit traffic
Network-level controls like ACLs or WAF rules can block known exploit paths until the patch can be applied.
Question 6: What does the EPSS (Exploit Prediction Scoring System) measure?
- The number of public exploits for a CVE
- The probability that a CVE will be exploited in the wild within 30 days (Correct answer)
- The severity of a vulnerability's impact on confidentiality
- The time a vendor takes to release a patch
Correct answer: The probability that a CVE will be exploited in the wild within 30 days
EPSS produces a probability score (0–1) estimating the likelihood of exploitation in the next 30 days.
Question 7: Which vulnerability management metric measures the average time between vulnerability discovery and successful remediation?
- Mean Time to Detect (MTTD)
- Mean Time to Remediate (MTTR) (Correct answer)
- Patch compliance rate
- Vulnerability density
Correct answer: Mean Time to Remediate (MTTR)
Mean Time to Remediate (MTTR) tracks how quickly an organization closes vulnerabilities after they are identified.
CCD Vulnerability Assessment & Management 2
Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for the vulnerability to be exploited?