CCD Vulnerability Assessment & Management 3 — Questions and Answers
Question 1: Which NVD/NIST database field provides a standardized list of weakness types that underlie CVEs?
- CPE
- CWE (Correct answer)
- CVSS
- CCE
Correct answer: CWE
CWE (Common Weakness Enumeration) categorizes the underlying software flaw types that lead to vulnerabilities.
Question 2: During a vulnerability scan, a finding is marked 'False Positive.' What is the correct next step?
- Immediately patch the finding
- Validate and document the exception in the vulnerability management platform (Correct answer)
- Escalate to incident response
- Rescan without credentials
Correct answer: Validate and document the exception in the vulnerability management platform
False positives must be validated through manual verification and formally documented as exceptions to keep scan results accurate.
Question 3: What is the main risk of scanning production systems during peak business hours?
- Scans will miss vulnerabilities on active connections
- Network-intensive scans can degrade service availability (Correct answer)
- Authentication tokens expire too quickly
- Scanners cannot run while users are logged in
Correct answer: Network-intensive scans can degrade service availability
Aggressive scanning can saturate network bandwidth or trigger resource exhaustion on production hosts during peak load.
Question 4: Which phase of the vulnerability management lifecycle involves determining which assets exist and what software they run?
- Remediation
- Verification
- Asset discovery and inventory (Correct answer)
- Risk acceptance
Correct answer: Asset discovery and inventory
Asset discovery and inventory is the foundation phase where the scope of systems and software is established before scanning.
Question 5: A security team discovers a zero-day vulnerability in a critical application with no available patch. Which action should be taken FIRST?
- Decommission the application immediately
- Implement temporary mitigations and increase monitoring (Correct answer)
- Wait for the vendor patch before acting
- Publicly disclose the vulnerability to pressure the vendor
Correct answer: Implement temporary mitigations and increase monitoring
When no patch exists, organizations should apply available mitigations and enhance monitoring to detect exploitation attempts.
Question 6: Which of the following BEST describes a vulnerability assessment compared to a penetration test?
- A vulnerability assessment actively exploits weaknesses to demonstrate impact
- A vulnerability assessment identifies and prioritizes flaws without exploiting them (Correct answer)
- Penetration tests use automated scanners exclusively
- Vulnerability assessments are only performed on web applications
Correct answer: A vulnerability assessment identifies and prioritizes flaws without exploiting them
Vulnerability assessments enumerate and prioritize weaknesses; penetration tests go further by actively exploiting them.
Question 7: When applying the DREAD scoring model, which factor estimates the number of people affected by a vulnerability?
- Damage potential
- Exploitability
- Affected users (Correct answer)
- Discoverability
Correct answer: Affected users
The 'Affected users' component in DREAD scores how broadly exploitation would impact the user population.
CCD Vulnerability Assessment & Management 3
Which NVD/NIST database field provides a standardized list of weakness types that underlie CVEs?