CND Threat Assessment & Vulnerability Management 2

Question 1

Which vulnerability scoring system provides a standardized method for rating the severity of security vulnerabilities?

Accepted Answer

CVSS

Answer

The Common Vulnerability Scoring System (CVSS) is an open framework that provides a standardized way to communicate the characteristics and severity of software vulnerabilities.

Question 2

A penetration tester discovers that an organization's web application allows SQL injection. In the threat modeling context, what does this represent?

Accepted Answer

A vulnerability

Answer

SQL injection is a vulnerability — a weakness in the system that can be exploited; the actual attack attempt would be the threat.

Question 3

During a vulnerability assessment, a scanner reports a finding with a CVSS Base Score of 9.8. How should this be prioritized?

Accepted Answer

Critical priority — remediate immediately

Answer

A CVSS score of 9.8 falls in the Critical range (9.0–10.0), requiring immediate remediation due to the high likelihood of exploitation and potential impact.

Question 4

What is the primary difference between a vulnerability scan and a penetration test?

Accepted Answer

Vulnerability scans identify weaknesses automatically; pen tests actively exploit them to confirm impact

Answer

Vulnerability scans discover and report potential weaknesses, while penetration tests go further by actively exploiting those weaknesses to demonstrate real-world impact.

Question 5

An organization uses threat intelligence feeds to identify indicators of compromise (IoCs). Which of the following is an example of an IoC?

Accepted Answer

A known malicious IP address communicating with internal hosts

Answer

Indicators of compromise (IoCs) are artifacts such as malicious IP addresses, domain names, or file hashes that indicate a system has been breached or is under attack.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Threat Assessment & Vulnerability Management 2