CVA Reporting Findings & Compliance Standards 2

Question 1

Which risk rating system uses a 0–10 numeric score to prioritize vulnerability severity in assessment reports?

Accepted Answer

CVSS (Common Vulnerability Scoring System)

Answer

CVSS provides a standardized 0–10 numeric score that helps organizations prioritize remediation based on vulnerability severity.

Question 2

In a vulnerability assessment report, the 'executive summary' section is primarily intended for which audience?

Accepted Answer

C-suite and non-technical decision makers

Answer

The executive summary conveys high-level risk posture and business impact to senior leadership who may lack technical backgrounds.

Question 3

Under PCI DSS, how frequently must internal vulnerability scans be performed at minimum?

Accepted Answer

Quarterly

Answer

PCI DSS Requirement 11.3 mandates internal vulnerability scans at least quarterly to maintain cardholder data environment security.

Question 4

Which report element describes the specific steps taken to discover a vulnerability, enabling the reader to reproduce findings?

Accepted Answer

Methodology section

Answer

The methodology section documents tools, techniques, and scope applied during the assessment so findings can be validated and reproduced.

Question 5

A vulnerability assessor must report a critical finding to a client mid-engagement that could allow immediate data exfiltration. What is the best course of action?

Accepted Answer

Issue an out-of-band verbal or written notification immediately

Answer

Critical findings with immediate business risk require prompt out-of-band notification rather than waiting for the final deliverable.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA Reporting Findings & Compliance Standards 2