Vulnerability Assessment Concepts Flashcards
6 cards from real CCST practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Vulnerability Assessment Concepts flashcards as text
What is the primary difference between a vulnerability scan and a penetration test?
Answer: Scans identify known weaknesses automatically; pen tests actively exploit vulnerabilities to assess real-world risk
Vulnerability scans are automated identification; pen tests are active exploitation by skilled testers.
What does CVSS measure?
Answer: Severity of a vulnerability scored from 0 to 10 based on exploitability and impact
CVSS rates severity using metrics including attack vector, complexity, privileges required, and CIA impact.
What is a false positive in vulnerability scanning?
Answer: A scan result incorrectly reporting a vulnerability that does not exist
False positives report vulnerabilities not actually present, often from incorrect version detection or overly broad signatures.
What is the purpose of asset inventory in vulnerability management?
Answer: To maintain a complete record of all systems so vulnerabilities can be identified across the entire environment
Asset inventory ensures all hardware, software, and services are known so nothing is missed during scanning.
What is risk prioritization in vulnerability management?
Answer: Ranking vulnerabilities by severity, asset criticality, threat intelligence, and business context to determine remediation order
Combines CVSS score, asset criticality, exploitation status, and business context to focus on greatest risks first.
What is an authenticated vulnerability scan and why is it more accurate?
Answer: A scan that logs into targets with valid credentials to check patches and configurations from inside
Authenticated scans log into systems to examine installed software, patches, and configurations, reducing false positives and negatives.