CCST Vulnerability Assessment Concepts 2

Question 1

What is the primary difference between a vulnerability scan and a penetration test?

Accepted Answer

Scans identify known weaknesses automatically; pen tests actively exploit vulnerabilities to assess real-world risk

Answer

Vulnerability scans are automated identification; pen tests are active exploitation by skilled testers.

Question 2

What does CVSS measure?

Accepted Answer

Severity of a vulnerability scored from 0 to 10 based on exploitability and impact

Answer

CVSS rates severity using metrics including attack vector, complexity, privileges required, and CIA impact.

Question 3

What is a false positive in vulnerability scanning?

Accepted Answer

A scan result incorrectly reporting a vulnerability that does not exist

Answer

False positives report vulnerabilities not actually present, often from incorrect version detection or overly broad signatures.

Question 4

What is the purpose of asset inventory in vulnerability management?

Accepted Answer

To maintain a complete record of all systems so vulnerabilities can be identified across the entire environment

Answer

Asset inventory ensures all hardware, software, and services are known so nothing is missed during scanning.

Question 5

What is risk prioritization in vulnerability management?

Accepted Answer

Ranking vulnerabilities by severity, asset criticality, threat intelligence, and business context to determine remediation order

Answer

Combines CVSS score, asset criticality, exploitation status, and business context to focus on greatest risks first.

(CCST) Cisco Certified Support Technician Practice Test