CSS CSS Vulnerability Management & Penetration Testing

Question 1

What does the Common Vulnerability Scoring System (CVSS) measure?

Accepted Answer

The severity of security vulnerabilities using a standardized numerical score from 0 to 10

Answer

The number of systems affected by a vulnerability

Answer

The cost to remediate a vulnerability

Answer

The number of exploit attempts detected

Question 2

What is the difference between a vulnerability scan and a penetration test?

Accepted Answer

A vulnerability scan identifies known weaknesses automatically; a penetration test actively attempts to exploit them

Answer

A penetration test is automated; a vulnerability scan requires manual effort

Answer

Vulnerability scans are more thorough than penetration tests

Answer

They are the same process with different names

Question 3

What is a zero-day vulnerability?

Accepted Answer

A vulnerability that is unknown to the software vendor and has no available patch

Answer

A vulnerability discovered on the first day of a software release

Answer

A vulnerability that takes zero days to exploit

Answer

A vulnerability with a CVSS score of zero

Question 4

Which penetration testing phase involves gathering information about the target without directly interacting with its systems?

Accepted Answer

Passive reconnaissance

Answer

Active scanning

Answer

Exploitation

Answer

Post-exploitation

Question 5

What is the purpose of patch management in vulnerability management?

Accepted Answer

Systematically identifies, tests, and deploys software updates to remediate known vulnerabilities

Answer

Blocks all external traffic until patches are available

Answer

Generates vulnerability reports for auditors

Answer

Scans systems for malware after exploitation

Question 6

What does 'attack surface reduction' mean in vulnerability management?

Accepted Answer

Minimizing the number of exposed entry points that attackers could exploit

Answer

Reducing the size of the security team

Answer

Removing all internet connectivity

Answer

Limiting the number of vulnerability scans performed