Certified Vulnerability Assessor (C)VA) — Questions and Answers

Question 1: What security risk does 'public cloud snapshot exposure' present during a cloud vulnerability assessment?

Snapshots cannot be restored if made public
Public snapshots prevent backup automation
Snapshots consume excessive storage costs
Public EBS or disk snapshots can be accessed by any AWS account, potentially exposing sensitive data or credentials (Correct answer)

Correct answer: Public EBS or disk snapshots can be accessed by any AWS account, potentially exposing sensitive data or credentials

Public cloud snapshots (e.g., AWS EBS snapshots) can be mounted by any account, allowing attackers to extract file systems, credentials, and configuration data.

Question 2: Which attack exploits the multi-tenancy nature of cloud platforms to infer information about other tenants through shared hardware resources?

Tenant spoofing
Resource exhaustion attack
Cross-tenant injection
Side-channel attack (e.g., Spectre/Meltdown) (Correct answer)

Correct answer: Side-channel attack (e.g., Spectre/Meltdown)

Side-channel attacks like Spectre and Meltdown exploit shared hardware resources (CPU caches, branch predictors) in multi-tenant cloud environments to leak data across tenant boundaries.

Question 3: Which attack against wireless networks involves sending continuous deauthentication frames to prevent legitimate clients from maintaining connectivity?

Wireless denial of service (DoS) via deauthentication flooding (Correct answer)
Beacon frame spoofing
WPA handshake capture attack
Channel hopping interference

Correct answer: Wireless denial of service (DoS) via deauthentication flooding

Wireless DoS via deauthentication flooding exploits 802.11's unauthenticated management frames to continuously disconnect clients, preventing legitimate wireless connectivity.

Question 4: What is a 'buffer overflow' vulnerability and how is it typically exploited?

A programming flaw where more data is written to a fixed-size buffer than it can hold, allowing attackers to overwrite adjacent memory including return addresses (Correct answer)
A database query error causing data corruption
A network protocol error causing packet loss
A web application vulnerability allowing file inclusion

Correct answer: A programming flaw where more data is written to a fixed-size buffer than it can hold, allowing attackers to overwrite adjacent memory including return addresses

Buffer overflow vulnerabilities occur when programs fail to validate input size, allowing attackers to overwrite adjacent memory — including function return addresses — to redirect code execution.

Question 5: During a physical security walk-through, you notice employees often prop open secured doors for convenience. What control weakness does this represent?

Lack of security guard staffing
Door prop detection and security culture failure — access controls are bypassed by user behavior (Correct answer)
Insufficient lighting in secured areas
Inadequate visitor management procedures

Correct answer: Door prop detection and security culture failure — access controls are bypassed by user behavior

Propping open secured doors bypasses physical access controls and represents both a technical control failure (no door prop alarms) and a security culture issue requiring awareness training.

Question 6: Which approach is recommended for secrets management in cloud-native applications to avoid hardcoded credentials?

Storing secrets in Docker environment variables
Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials (Correct answer)
Encoding secrets in Base64 and storing in config files
Rotating secrets manually every 90 days

Correct answer: Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials

Dedicated secrets managers provide centralized storage, automatic rotation, and audit logging for credentials, eliminating the need for hardcoded or static secrets.

Question 7: What is the primary purpose of Metasploit Framework in a vulnerability assessment engagement?

Passive network traffic analysis
Exploiting known vulnerabilities to demonstrate proof-of-concept compromise and validate scanner findings (Correct answer)
Generating compliance reports
Scanning for open ports and services

Correct answer: Exploiting known vulnerabilities to demonstrate proof-of-concept compromise and validate scanner findings

Metasploit provides a collection of exploits, payloads, and auxiliary modules used to validate whether identified vulnerabilities are actually exploitable in the target environment.

Question 8: In assessing serverless function security (e.g., AWS Lambda), what is a key vulnerability to test for?

Insufficient RAM allocation
Missing load balancer configuration
Insecure environment variables storing plaintext credentials (Correct answer)
Lack of operating system patching

Correct answer: Insecure environment variables storing plaintext credentials

Serverless functions often store sensitive credentials in environment variables that may be exposed through verbose error messages, logs, or if the function code itself is compromised.

Question 9: Which standard provides a structured vulnerability disclosure process used by vendors and researchers to coordinate patching before public release?

PCI DSS v4.0
ISO/IEC 29147 (Correct answer)
OWASP ASVS
NIST SP 800-53

Correct answer: ISO/IEC 29147

ISO/IEC 29147 provides international guidance on vulnerability disclosure, defining roles and processes for coordinated disclosure between researchers and vendors.

Question 10: Which cloud vulnerability involves functions or services that trigger other services in an uncontrolled chain, potentially leading to infinite loops or cost exhaustion?

Resource exhaustion / event-driven attack (Correct answer)
Insecure trigger configuration
Event injection
Function chain vulnerability

Correct answer: Resource exhaustion / event-driven attack

Serverless resource exhaustion attacks exploit event-driven architectures to trigger cascading function invocations, causing denial of service or unexpected cost escalation.

Question 11: Which attack technique involves manipulating the return address on the stack to point to attacker-controlled shellcode?

Heap spray
Stack-based buffer overflow (Correct answer)
Use-after-free
Integer overflow

Correct answer: Stack-based buffer overflow

Stack-based buffer overflow overwrites the saved return address on the program's stack, redirecting execution to attacker-supplied shellcode when the function returns.

Question 12: What technique is used to bypass Data Execution Prevention (DEP/NX) protections during exploitation?

Heap spraying with NOP sleds
Return-Oriented Programming (ROP) (Correct answer)
Integer overflow attacks
Format string exploitation

Correct answer: Return-Oriented Programming (ROP)

Return-Oriented Programming (ROP) chains together small snippets of legitimate executable code ('gadgets') already in memory, bypassing DEP by never executing attacker-supplied code.

Question 13: A risk analyst identifies a new zero-day vulnerability with no available patch. Which mitigation strategy is MOST appropriate in the short term?

Avoid the risk by rebuilding all affected systems immediately
Implement compensating controls such as network segmentation and enhanced monitoring (Correct answer)
Accept the risk and wait for a vendor patch
Transfer the risk by notifying the vendor

Correct answer: Implement compensating controls such as network segmentation and enhanced monitoring

When no patch exists, compensating controls like segmentation and monitoring reduce exposure and detect exploitation attempts until a patch is available.

Question 14: What is 'lateral movement' in the context of a cloud environment breach?

Moving data between cloud regions
Scaling cloud resources horizontally
Attackers pivoting from one compromised cloud resource to access other resources within the same environment (Correct answer)
Migrating workloads between cloud providers

Correct answer: Attackers pivoting from one compromised cloud resource to access other resources within the same environment

Lateral movement in cloud environments involves attackers using compromised resources to access and exploit other resources, escalating the breach across the cloud tenant.

Question 15: What is 'spear phishing' and how does it differ from regular phishing?

Spear phishing uses malware attachments while regular phishing uses links
Spear phishing uses phone calls while regular phishing uses email
Spear phishing targets technical staff while regular phishing targets executives
Spear phishing is highly targeted at specific individuals using personalized information, while regular phishing is sent broadly (Correct answer)

Correct answer: Spear phishing is highly targeted at specific individuals using personalized information, while regular phishing is sent broadly

Spear phishing uses personalized details (name, role, recent activities) gathered through OSINT to craft convincing targeted attacks, unlike bulk phishing sent to many recipients without personalization.

Question 16: During a cloud environment vulnerability assessment, which service endpoint is commonly targeted to retrieve AWS credentials from an EC2 instance?

10.0.0.1 (Default Gateway)
192.168.1.1 (Cloud Router)
172.16.0.1 (Internal DNS)
169.254.169.254 (Instance Metadata Service) (Correct answer)

Correct answer: 169.254.169.254 (Instance Metadata Service)

The AWS Instance Metadata Service (IMDS) at 169.254.169.254 can expose IAM role credentials to attackers who achieve SSRF or internal access to an EC2 instance.

Question 17: What is a common weakness found in wireless networks?

Strong encryption usage.
Weak or default passwords (Correct answer)
Hidden SSID broadcasting.
Frequent password changes.

Correct answer: Weak or default passwords

A common and significant weakness in wireless networks is the use of weak, easily guessable, or default passwords. Many devices come with factory-set default credentials that are publicly known, or users choose simple passwords for convenience. Attackers can easily exploit these to gain unauthorized access to the network, compromising data and potentially launching further attacks.

Question 18: What is 'pass-the-hash' and why is it significant in post-exploitation?

Hashing data to verify file integrity after exploitation
Passing encrypted credentials between domain controllers
Using captured NTLM password hashes to authenticate to services without knowing the plaintext password (Correct answer)
Cracking password hashes using rainbow tables

Correct answer: Using captured NTLM password hashes to authenticate to services without knowing the plaintext password

Pass-the-hash uses a captured NTLM hash directly for authentication against Windows services, bypassing the need to crack the hash to plaintext — enabling lateral movement across the network.

Question 19: What does the term 'attack surface' mean in vulnerability assessment?

The physical area of a server room accessible to unauthorized persons
The network bandwidth consumed during an active scan
The total set of points where an attacker can try to enter or extract data from a system (Correct answer)
The severity score assigned to a discovered vulnerability

Correct answer: The total set of points where an attacker can try to enter or extract data from a system

Attack surface encompasses all entry points, interfaces, and exposed components that an attacker could potentially exploit to compromise a system.

Question 20: What does 'fuzzing' accomplish in vulnerability research and assessment?

Scanning for open network ports and services
Analyzing application source code for logical flaws
Encrypting network communications to assess cipher strength
Sending large amounts of random, malformed, or unexpected input to applications to discover crashes and potential vulnerabilities (Correct answer)

Correct answer: Sending large amounts of random, malformed, or unexpected input to applications to discover crashes and potential vulnerabilities

Fuzzing automatically generates malformed inputs and monitors target applications for crashes, unexpected behavior, or security violations that indicate exploitable vulnerabilities.

Question 21: Which cloud security tool is used by assessors to identify misconfigured IAM policies, open security groups, and exposed resources in AWS environments?

Nessus
ScoutSuite (Correct answer)
OpenVAS
Burp Suite

Correct answer: ScoutSuite

ScoutSuite is a multi-cloud security auditing tool that assesses cloud provider configurations, identifying IAM misconfigurations, open security groups, and excessive permissions.

Question 22: Which Windows registry hive stores machine-wide configuration settings applicable to all users?

HKEY_LOCAL_MACHINE (HKLM) (Correct answer)
HKEY_USERS (HKU)
HKEY_CURRENT_USER (HKCU)
HKEY_CLASSES_ROOT (HKCR)

Correct answer: HKEY_LOCAL_MACHINE (HKLM)

HKEY_LOCAL_MACHINE (HKLM) contains system-wide configuration settings including hardware, software, and security policies that apply to all users on the machine.

Question 23: In Metasploit, what is a 'payload' in the context of exploitation?

The authentication bypass technique used against the target
The encrypted tunnel used for command and control communication
The initial network packet sent to identify open ports
The code executed on the target system after a successful exploit to achieve an attacker objective (Correct answer)

Correct answer: The code executed on the target system after a successful exploit to achieve an attacker objective

A payload is the code delivered through an exploit that executes on the compromised target, providing the attacker with capabilities like a shell, Meterpreter session, or file execution.

Question 24: What is a 'use-after-free' vulnerability?

A web vulnerability allowing reuse of expired session tokens
A database vulnerability enabling reuse of deleted records
A network protocol flaw allowing session replay
A vulnerability where freed memory is subsequently accessed and potentially controlled by an attacker to achieve code execution (Correct answer)

Correct answer: A vulnerability where freed memory is subsequently accessed and potentially controlled by an attacker to achieve code execution

Use-after-free vulnerabilities occur when a program continues to use a memory pointer after the referenced memory has been freed, allowing attackers to control the freed memory and achieve code execution.

Question 25: Which Kubernetes misconfiguration exposes the cluster API server to unauthenticated access?

Enabling RBAC with default roles
Using namespaces to separate workloads
Enabling network policies
Leaving the API server accessible on port 6443 without authentication (anonymous-auth=true) (Correct answer)

Correct answer: Leaving the API server accessible on port 6443 without authentication (anonymous-auth=true)

Enabling anonymous authentication on the Kubernetes API server allows unauthenticated users to interact with the cluster, potentially executing privileged operations.

Question 26: What is the key difference between a vulnerability scanner and a penetration testing tool?

Vulnerability scanners require root access; penetration tools work as standard users
Vulnerability scanners identify weaknesses without exploiting them; penetration tools actively exploit (Correct answer)
Penetration tools only test web applications; scanners test network hosts
Vulnerability scanners require physical access; penetration tools work remotely

Correct answer: Vulnerability scanners identify weaknesses without exploiting them; penetration tools actively exploit

Vulnerability scanners detect and report potential weaknesses passively, while penetration testing tools attempt to actively exploit those weaknesses to confirm their impact.

Question 27: What is the purpose of 'encoder' modules in exploit frameworks like Metasploit?

To compress payload size for faster delivery
To convert exploit code between programming languages
To speed up exploitation by pre-compiling shellcode
To obfuscate payloads to evade signature-based detection by antivirus or IDS (Correct answer)

Correct answer: To obfuscate payloads to evade signature-based detection by antivirus or IDS

Encoder modules transform payload shellcode to avoid bad characters and evade signature-based detection, though modern AV/EDR has largely reduced their effectiveness.

Question 28: What is the primary security control that Address Space Layout Randomization (ASLR) provides against exploit attacks?

Prevents code from executing from non-executable memory regions
Encrypts executable code in memory
Randomizes the memory addresses of key program components, making it harder to predict addresses needed for reliable exploitation (Correct answer)
Monitors system calls for malicious patterns

Correct answer: Randomizes the memory addresses of key program components, making it harder to predict addresses needed for reliable exploitation

ASLR randomizes base addresses of the stack, heap, and loaded libraries each time a program runs, making it significantly harder for attackers to reliably jump to known memory locations.

Question 29: What is the purpose of testing cloud Identity Federation configurations during a vulnerability assessment?

To validate cloud provider SLA compliance
To identify trust relationships that could allow external identity providers to grant unauthorized cloud access (Correct answer)
To assess network bandwidth between cloud regions
To verify that cloud storage is encrypted

Correct answer: To identify trust relationships that could allow external identity providers to grant unauthorized cloud access

Identity Federation misconfigurations can allow external IdPs to grant excessive cloud permissions, enabling unauthorized access if the trust relationship is overly permissive.

Question 30: What is the primary purpose of the Metasploit Framework's 'auxiliary' modules?

Exploiting remote vulnerabilities
Scanning, fuzzing, and information gathering without exploitation (Correct answer)
Delivering shellcode payloads
Generating post-exploitation reports

Correct answer: Scanning, fuzzing, and information gathering without exploitation

Auxiliary modules perform support tasks such as scanning, fuzzing, sniffing, and banner grabbing without launching an exploit against a target.

Certified Vulnerability Assessor (C)VA)

The Mile2 Certified Vulnerability Assessor (C)VA) exam validates skills in identifying, classifying, and remediating security vulnerabilities across operating systems, cloud environments, and exploit frameworks using industry-standard tools and methodologies.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

mile2.com — Test delivery, eligibility, retake policy, score validity, passing score, fees · verified Oct 2026