CCD Vulnerability Assessment & Management 2

Question 1

Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for the vulnerability to be exploited?

Accepted Answer

Attack Complexity

Answer

Attack Complexity (AC) captures conditions outside attacker control, such as race conditions or specific configuration states.

Question 2

A vulnerability scanner reports a finding with CVSS score 9.8. Which risk category does this fall under?

Accepted Answer

Critical

Answer

CVSS scores 9.0–10.0 are classified as Critical severity.

Question 3

What is the primary purpose of a vulnerability disclosure policy (VDP)?

Accepted Answer

Provide a structured channel for external researchers to report flaws safely

Answer

A VDP establishes rules of engagement and a safe reporting channel for external security researchers.

Question 4

Which technique allows a vulnerability scanner to obtain more accurate results by using system credentials?

Accepted Answer

Credentialed scanning

Answer

Credentialed (authenticated) scanning logs into the target to inspect installed software, registry, and configuration directly.

Question 5

An organization receives a vendor patch but cannot apply it immediately due to operational constraints. Which compensating control is MOST appropriate for a critical network service vulnerability?

Accepted Answer

Apply a WAF rule or network ACL to block exploit traffic

Answer

Network-level controls like ACLs or WAF rules can block known exploit paths until the patch can be applied.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Vulnerability Assessment & Management 2