CVA Reporting Findings & Compliance Standards 3

Question 1

Which NIST publication provides guidance on the vulnerability management lifecycle, including reporting phases?

Accepted Answer

NIST SP 800-40

Answer

NIST SP 800-40 specifically addresses patch and vulnerability management, including guidance on prioritization and reporting.

Question 2

A false positive in a vulnerability scan report is best described as:

Accepted Answer

A vulnerability reported that does not actually exist in the target

Answer

A false positive occurs when the scanner flags a vulnerability that manual validation confirms does not actually exist in the environment.

Question 3

Under SOC 2 Type II requirements, how long must an organization demonstrate continuous control effectiveness for reporting purposes?

Accepted Answer

A minimum observation period (typically 6–12 months)

Answer

SOC 2 Type II reports cover a defined period (commonly 6–12 months) to demonstrate sustained control effectiveness over time.

Question 4

Which section of a vulnerability assessment report maps discovered weaknesses to specific business assets and quantifies potential financial impact?

Accepted Answer

Risk register or risk matrix

Answer

The risk register or risk matrix correlates vulnerabilities with affected assets and estimates business impact to guide prioritization.

Question 5

ISO/IEC 27001 requires organizations to document vulnerability management results in which artifact?

Accepted Answer

Risk treatment plan

Answer

ISO 27001 Annex A Control 8.8 requires identified vulnerabilities to be addressed within a risk treatment plan documenting selected controls.

(CVA) Certified Vulnerability Assessor Practice Test