CVA Reporting Findings & Compliance Standards 5

Question 1

Which standard provides a structured vulnerability disclosure process used by vendors and researchers to coordinate patching before public release?

Accepted Answer

ISO/IEC 29147

Answer

ISO/IEC 29147 provides international guidance on vulnerability disclosure, defining roles and processes for coordinated disclosure between researchers and vendors.

Question 2

When assigning severity in a report, which factor would most likely DECREASE a CVSS base score?

Accepted Answer

High privileges required to exploit

Answer

Requiring high privileges to exploit a vulnerability reduces its CVSS score because it limits who can carry out the attack.

Question 3

A client requests that a vulnerability with active exploit code be omitted from the final report to avoid alarming stakeholders. What should the assessor do?

Accepted Answer

Include the finding and document client's request to omit it

Answer

Assessors must maintain report integrity; the finding should be included while documenting the client's request to ensure accountability.

Question 4

GDPR Article 33 requires that personal data breaches discovered during a vulnerability assessment be reported to the supervisory authority within:

Accepted Answer

72 hours

Answer

GDPR mandates notifying the relevant supervisory authority within 72 hours of becoming aware of a personal data breach unless it poses no risk.

Question 5

Which vulnerability assessment report component provides step-by-step instructions to eliminate or mitigate each identified weakness?

Accepted Answer

Remediation recommendations

Answer

Remediation recommendations give technical teams actionable steps to fix or mitigate vulnerabilities, including patches, configuration changes, or compensating controls.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA Reporting Findings & Compliance Standards 5