CVA Cheat Sheet 2026

The 30 highest-yield CVA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. A network assessment reveals that core switches have CDP (Cisco Discovery Protocol) enabled on external-facing interfaces. What information is exposed? → Device model, IOS version, IP addresses, and VLAN configurations
2. Which tool is specifically designed to perform automated scanning of web application vulnerabilities including SQLi, XSS, and LFI? → Nikto
3. Which method can help reduce scan noise and improve accuracy when assessing a large enterprise network? → Segmenting scans by subnet and scheduling during off-peak hours
4. Which risk mitigation strategy involves outsourcing risk to a third party such as purchasing cyber liability insurance? → Risk transference
5. ISO/IEC 27001 requires organizations to document vulnerability management results in which artifact? → Risk treatment plan
6. Which tool is commonly used during wireless assessments to capture WPA/WPA2 handshakes for offline password cracking? → Aircrack-ng suite (airodump-ng)
7. Which tool is commonly used for network vulnerability scanning? → Nessus
8. What can an open port on a network indicate? → Potential security risk
9. Which method identifies vulnerabilities without disrupting services? → Non-intrusive scanning
10. What is a risk mitigation strategy? → Take steps to reduce risks
11. An organization wants to measure the effectiveness of its risk mitigation controls over time. Which metric is MOST useful? → Reduction in residual risk after control implementation
12. Which technique involves sending packets with unusual flag combinations (e.g., all flags set) to elicit responses that reveal firewall or OS behavior? → Xmas scan
13. An assessor finds that an organization uses telnet for out-of-band management of network devices. What is the critical weakness? → All management credentials and commands are transmitted in cleartext
14. A vulnerability assessor discovers that a router accepts SNMP queries using the community string 'public'. What is the primary risk? → Unauthorized read access to device configuration and network topology data
15. A vulnerability assessor needs to identify open ports on a target that blocks ICMP. Which Nmap technique is MOST appropriate? → TCP SYN scan with ICMP disabled (-Pn)
16. Which of the following BEST describes a qualitative risk analysis approach? → Uses descriptive scales such as High, Medium, and Low to rank risk
17. Which compliance regulation protects consumer financial information? → GLBA
18. Which burp suite feature is most useful for identifying hidden parameters and endpoints during a web application assessment? → Burp Crawl and Audit (Scanner)
19. What is patch management's role in vulnerability assessment? → Fix vulnerabilities by applying software updates
20. Which of the following scenarios BEST illustrates a 'secondary risk' introduced by a risk mitigation action? → A firewall rule blocks an attacker but also disrupts legitimate business traffic
21. Which technique uses known-good configuration baselines to detect deviations that may indicate a vulnerability or misconfiguration? → Compliance/configuration auditing
22. The FAIR (Factor Analysis of Information Risk) model decomposes risk into which two primary components? → Loss event frequency and probable loss magnitude
23. A CVA assessor finds that network devices have HTTP management interfaces enabled in addition to HTTPS. What remediation should be recommended? → Disable HTTP and enforce HTTPS-only management with HSTS to prevent protocol downgrade
24. Which attack exploits the multi-tenancy nature of cloud platforms to infer information about other tenants through shared hardware resources? → Side-channel attack (e.g., Spectre/Meltdown)
25. Which mitigation approach involves adding security controls that operate independently yet protect the same asset, ensuring protection if one control fails? → Defense in depth
26. What is the primary purpose of Address Space Layout Randomization (ASLR)? → To randomize memory addresses of key data areas, making exploitation harder
27. Which report element is specifically designed to track open findings from previous assessments and confirm their current remediation status? → Remediation tracking or findings retest section
28. What is the purpose of Windows User Account Control (UAC)? → To require explicit elevation approval before allowing administrative actions
29. What is privilege escalation in the context of operating system security? → Gaining higher-level permissions than originally granted to a user or process
30. Which technique allows an attacker to bypass port-based NAC (802.1X) by copying the MAC address of an authenticated device? → MAC spoofing / identity theft against 802.1X MAC-based authentication bypass