CySA+ Test Vulnerability Management 2 — Questions and Answers
Question 1: Which metric in CVSSv3 indicates that an attacker must be on the same logical or physical network as the vulnerable system to exploit it?
- Attack Vector: Network
- Attack Vector: Adjacent (Correct answer)
- Attack Vector: Local
- Attack Vector: Physical
Correct answer: Attack Vector: Adjacent
The Adjacent (A) attack vector requires the attacker to be on the same network segment or broadcast domain as the target.
Question 2: A vulnerability scanner returns a finding with a CVSS base score of 9.8. Before prioritizing remediation, which contextual factor should a security analyst evaluate FIRST?
- Whether the finding has a public proof-of-concept exploit
- Whether the affected asset is internet-facing and stores sensitive data (Correct answer)
- Whether the CVE was published in the last 30 days
- Whether the vendor has released a patch
Correct answer: Whether the affected asset is internet-facing and stores sensitive data
Asset criticality and exposure context determine true business risk; a high CVSS score on an isolated, non-critical system may rank lower than a moderate score on an internet-facing critical asset.
Question 3: What is the primary purpose of credentialed scanning versus unauthenticated scanning?
- Credentialed scans run faster and produce fewer false positives
- Credentialed scans can enumerate installed software, patch levels, and local configuration without relying on exposed network services (Correct answer)
- Unauthenticated scans require more network bandwidth
- Credentialed scans only work on Windows systems
Correct answer: Credentialed scans can enumerate installed software, patch levels, and local configuration without relying on exposed network services
Providing scanner credentials allows it to log into hosts and inspect installed packages, registry settings, and configuration files, producing far more comprehensive and accurate results.
Question 4: Which vulnerability remediation strategy involves deploying a temporary measure to reduce risk while a permanent patch is being developed or tested?
- Patch management
- Compensating control (Correct answer)
- Risk acceptance
- Vulnerability suppression
Correct answer: Compensating control
A compensating control (e.g., WAF rule, network ACL) reduces exploitability temporarily until a proper fix is available.
Question 5: An analyst discovers that a critical vulnerability on a legacy PLC cannot be patched due to vendor support constraints. What is the MOST appropriate response?
- Decommission the system immediately
- Accept the risk and document it with no further action
- Implement network segmentation and enhanced monitoring as compensating controls (Correct answer)
- Run daily vulnerability scans against the device
Correct answer: Implement network segmentation and enhanced monitoring as compensating controls
When patching is not feasible, isolating the system via network segmentation and increasing monitoring reduces the attack surface and detection time.
Question 6: Which type of vulnerability scan examines whether web application inputs are sanitized to prevent injection attacks without requiring source-code access?
- Network-based scan
- Static application security testing (SAST)
- Dynamic application security testing (DAST) (Correct answer)
- Software composition analysis (SCA)
Correct answer: Dynamic application security testing (DAST)
DAST tests a running application from the outside by sending malicious inputs to find injection, authentication, and configuration flaws.
Question 7: A CySA+ analyst needs to prioritize hundreds of vulnerabilities. Which combination of factors BEST represents an effective risk-based prioritization model?
- CVE publication date and vendor severity rating
- CVSS base score, asset criticality, and exploitability in the wild (Correct answer)
- Number of affected hosts and time since last scan
- Patch availability and OS platform type
Correct answer: CVSS base score, asset criticality, and exploitability in the wild
Effective prioritization combines the technical severity (CVSS), business value of the asset, and whether active exploitation is occurring to focus remediation effort on the highest real-world risk.
CySA+ Test Vulnerability Management 2
Which metric in CVSSv3 indicates that an attacker must be on the same logical or physical network as the vulnerable system to exploit it?