CCD Vulnerability Assessment & Management 3

Question 1

Which NVD/NIST database field provides a standardized list of weakness types that underlie CVEs?

Accepted Answer

CWE

Answer

CWE (Common Weakness Enumeration) categorizes the underlying software flaw types that lead to vulnerabilities.

Question 2

During a vulnerability scan, a finding is marked 'False Positive.' What is the correct next step?

Accepted Answer

Validate and document the exception in the vulnerability management platform

Answer

False positives must be validated through manual verification and formally documented as exceptions to keep scan results accurate.

Question 3

What is the main risk of scanning production systems during peak business hours?

Accepted Answer

Network-intensive scans can degrade service availability

Answer

Aggressive scanning can saturate network bandwidth or trigger resource exhaustion on production hosts during peak load.

Question 4

Which phase of the vulnerability management lifecycle involves determining which assets exist and what software they run?

Accepted Answer

Asset discovery and inventory

Answer

Asset discovery and inventory is the foundation phase where the scope of systems and software is established before scanning.

Question 5

A security team discovers a zero-day vulnerability in a critical application with no available patch. Which action should be taken FIRST?

Accepted Answer

Implement temporary mitigations and increase monitoring

Answer

When no patch exists, organizations should apply available mitigations and enhance monitoring to detect exploitation attempts.

(CCD) Certified Cyber Defender Practice Test