CVA Reporting Findings & Compliance Standards 3 — Questions and Answers
Question 1: Which NIST publication provides guidance on the vulnerability management lifecycle, including reporting phases?
- NIST SP 800-30
- NIST SP 800-40 (Correct answer)
- NIST SP 800-115
- NIST SP 800-53
Correct answer: NIST SP 800-40
NIST SP 800-40 specifically addresses patch and vulnerability management, including guidance on prioritization and reporting.
Question 2: A false positive in a vulnerability scan report is best described as:
- A real vulnerability that was not detected by the scanner
- A vulnerability reported that does not actually exist in the target (Correct answer)
- A known vulnerability with no available patch
- A low-severity finding that was incorrectly rated as critical
Correct answer: A vulnerability reported that does not actually exist in the target
A false positive occurs when the scanner flags a vulnerability that manual validation confirms does not actually exist in the environment.
Question 3: Under SOC 2 Type II requirements, how long must an organization demonstrate continuous control effectiveness for reporting purposes?
- At least one month
- A point in time
- A minimum observation period (typically 6–12 months) (Correct answer)
- Exactly 90 days
Correct answer: A minimum observation period (typically 6–12 months)
SOC 2 Type II reports cover a defined period (commonly 6–12 months) to demonstrate sustained control effectiveness over time.
Question 4: Which section of a vulnerability assessment report maps discovered weaknesses to specific business assets and quantifies potential financial impact?
- Scope and limitations
- Risk register or risk matrix (Correct answer)
- Glossary of terms
- Tool configuration appendix
Correct answer: Risk register or risk matrix
The risk register or risk matrix correlates vulnerabilities with affected assets and estimates business impact to guide prioritization.
Question 5: ISO/IEC 27001 requires organizations to document vulnerability management results in which artifact?
- Statement of Applicability
- Risk treatment plan (Correct answer)
- Business impact analysis
- Penetration test report
Correct answer: Risk treatment plan
ISO 27001 Annex A Control 8.8 requires identified vulnerabilities to be addressed within a risk treatment plan documenting selected controls.
Question 6: When reporting vulnerabilities under responsible disclosure, what is the standard maximum embargo period before public disclosure?
- 7 days
- 30 days
- 90 days (Correct answer)
- 180 days
Correct answer: 90 days
The industry standard coordinated vulnerability disclosure window is 90 days, popularized by Google Project Zero, before public release.
Question 7: A CVE identifier in a vulnerability report primarily serves to:
- Assign a risk severity score from 0 to 10
- Provide a unique public reference to a specific known vulnerability (Correct answer)
- Indicate the patch release date from the vendor
- Define remediation steps for the vulnerability
Correct answer: Provide a unique public reference to a specific known vulnerability
CVE IDs provide a standardized, publicly referenced identifier so different tools and teams can unambiguously refer to the same vulnerability.
CVA Reporting Findings & Compliance Standards 3
Which NIST publication provides guidance on the vulnerability management lifecycle, including reporting phases?