CVA Vulnerability Assessment Tools & Techniques 3 — Questions and Answers
Question 1: Which technique involves sending packets with unusual flag combinations (e.g., all flags set) to elicit responses that reveal firewall or OS behavior?
- Idle/zombie scan
- Xmas scan (Correct answer)
- ACK scan
- FIN scan
Correct answer: Xmas scan
An Xmas scan sets FIN, PSH, and URG flags simultaneously; RFC-compliant closed ports respond with RST while open ports remain silent, helping map firewall rules.
Question 2: A security team wants to discover all assets on a network before scanning for vulnerabilities. Which process describes this step?
- Patch management
- Asset discovery / enumeration (Correct answer)
- Exploit validation
- Risk scoring
Correct answer: Asset discovery / enumeration
Asset discovery (enumeration) identifies all live hosts, IP addresses, and services on the network before vulnerability scanning begins.
Question 3: What is the role of the Common Vulnerability Scoring System (CVSS) in vulnerability assessment?
- Automating patch deployment to affected systems
- Providing a standardized numerical score reflecting vulnerability severity (Correct answer)
- Cataloging all known vulnerabilities in a searchable database
- Defining legal requirements for vulnerability disclosure
Correct answer: Providing a standardized numerical score reflecting vulnerability severity
CVSS provides a standardized framework with a 0–10 score that quantifies the severity of a vulnerability based on exploitability, impact, and environmental factors.
Question 4: Which Nessus feature allows policies to be saved and reused across multiple scans to ensure consistency?
- Plugin families
- Scan templates (Correct answer)
- Audit trails
- Compliance reports
Correct answer: Scan templates
Scan templates in Nessus store pre-configured settings including credentials, plugin selections, and targets so the same policy can be applied consistently to future scans.
Question 5: During a vulnerability assessment, an assessor identifies a CVE with a CVSS base score of 9.8. How should this finding be prioritized?
- Low priority — base scores ignore environmental context
- Medium priority — investigate after addressing informational findings
- Critical priority — remediate immediately or apply compensating controls (Correct answer)
- No priority — base scores only apply to internet-facing systems
Correct answer: Critical priority — remediate immediately or apply compensating controls
A CVSS base score of 9.8 is rated Critical (9.0–10.0), indicating high exploitability and impact, requiring immediate attention and remediation.
Question 6: What is the key difference between a vulnerability scanner and a penetration testing tool?
- Vulnerability scanners require physical access; penetration tools work remotely
- Vulnerability scanners identify weaknesses without exploiting them; penetration tools actively exploit (Correct answer)
- Penetration tools only test web applications; scanners test network hosts
- Vulnerability scanners require root access; penetration tools work as standard users
Correct answer: Vulnerability scanners identify weaknesses without exploiting them; penetration tools actively exploit
Vulnerability scanners detect and report potential weaknesses passively, while penetration testing tools attempt to actively exploit those weaknesses to confirm their impact.
Question 7: Which command-line tool can be used to capture network packets and analyze traffic for potential security issues during an assessment?
- Nmap
- Tcpdump (Correct answer)
- Nikto
- OpenVAS
Correct answer: Tcpdump
Tcpdump captures and displays network packet data in real time from the command line, enabling traffic analysis for cleartext credentials, unusual protocols, or suspicious patterns.
CVA Vulnerability Assessment Tools & Techniques 3
Which technique involves sending packets with unusual flag combinations (e.g., all flags set) to elicit responses that reveal firewall or OS behavior?