CCST Vulnerability Assessment Concepts 2

Question 1

What is the primary difference between a vulnerability scan and a penetration test?

Accepted Answer

Scans identify known weaknesses automatically; pen tests actively exploit vulnerabilities to assess real-world risk

Answer

No difference

Answer

Pen tests are automated; scans are manual

Answer

Scans are more expensive

Question 2

What does CVSS measure?

Accepted Answer

Severity of a vulnerability scored from 0 to 10 based on exploitability and impact

Answer

Financial cost of fixing a vulnerability

Answer

Number of affected systems

Answer

Time required to patch

Question 3

What is a false positive in vulnerability scanning?

Accepted Answer

A scan result incorrectly reporting a vulnerability that does not exist

Answer

A correctly identified vulnerability

Answer

A vulnerability that cannot be exploited

Answer

A scan finding nothing

Question 4

What is the purpose of asset inventory in vulnerability management?

Accepted Answer

To maintain a complete record of all systems so vulnerabilities can be identified across the entire environment

Answer

To calculate IT equipment cost

Answer

To determine which assets to sell

Answer

To schedule hardware replacement

Question 5

What is risk prioritization in vulnerability management?

Accepted Answer

Ranking vulnerabilities by severity, asset criticality, threat intelligence, and business context to determine remediation order

Answer

Fixing all vulnerabilities simultaneously

Answer

Ignoring low-severity vulnerabilities

Answer

Only addressing auditor-reported vulnerabilities

Question 6

What is an authenticated vulnerability scan and why is it more accurate?

Accepted Answer

A scan that logs into targets with valid credentials to check patches and configurations from inside

Answer

A scan requiring CVSS authentication

Answer

A scan certified by a third party

Answer

A scan checking only public-facing services