Vulnerability Assessment Concepts Flashcards
6 cards from real CCST practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Vulnerability Assessment Concepts flashcards as text
What is the purpose of a vulnerability remediation SLA?
Answer: To establish maximum timeframes for fixing vulnerabilities based on severity level
Remediation SLAs set maximum fix times: critical 24-72 hours, high 7-14 days, medium 30-60 days, low 90 days.
What is the difference between network and web application vulnerability scans?
Answer: Network scans check infrastructure for known CVEs; web app scans test for application-specific flaws like injection
Network scanners assess infrastructure (OS patches, ports); web app scanners test application-layer vulnerabilities (SQLi, XSS, OWASP Top 10).
What is a CVE identifier?
Answer: A standardized unique identifier for publicly known vulnerabilities for consistent reference
CVE assigns unique identifiers (e.g., CVE-2024-12345) maintained by MITRE for consistent vulnerability reference.
Why is vulnerability scanning alone insufficient for a complete security assessment?
Answer: Automated scans cannot test business logic, chain vulnerabilities, or assess real-world exploitability
Scans cannot understand business logic, demonstrate attack chains, or discover zero-day vulnerabilities.
What is a vulnerability management lifecycle?
Answer: A continuous process for discovering, assessing, prioritizing, remediating, and verifying vulnerabilities
The lifecycle is a continuous cycle: discover, assess, analyze, prioritize, remediate, verify, repeat.
What is a compensating control in vulnerability management?
Answer: An alternative security measure when a vulnerability cannot be directly remediated
Compensating controls reduce risk when direct patching is not feasible, such as network segmentation for legacy systems.