CySA+ Test Vulnerability Management 2

Question 1

Which metric in CVSSv3 indicates that an attacker must be on the same logical or physical network as the vulnerable system to exploit it?

Accepted Answer

Attack Vector: Adjacent

Answer

The Adjacent (A) attack vector requires the attacker to be on the same network segment or broadcast domain as the target.

Question 2

A vulnerability scanner returns a finding with a CVSS base score of 9.8. Before prioritizing remediation, which contextual factor should a security analyst evaluate FIRST?

Accepted Answer

Whether the affected asset is internet-facing and stores sensitive data

Answer

Asset criticality and exposure context determine true business risk; a high CVSS score on an isolated, non-critical system may rank lower than a moderate score on an internet-facing critical asset.

Question 3

What is the primary purpose of credentialed scanning versus unauthenticated scanning?

Accepted Answer

Credentialed scans can enumerate installed software, patch levels, and local configuration without relying on exposed network services

Answer

Providing scanner credentials allows it to log into hosts and inspect installed packages, registry settings, and configuration files, producing far more comprehensive and accurate results.

Question 4

Which vulnerability remediation strategy involves deploying a temporary measure to reduce risk while a permanent patch is being developed or tested?

Accepted Answer

Compensating control

Answer

A compensating control (e.g., WAF rule, network ACL) reduces exploitability temporarily until a proper fix is available.

Question 5

An analyst discovers that a critical vulnerability on a legacy PLC cannot be patched due to vendor support constraints. What is the MOST appropriate response?

Accepted Answer

Implement network segmentation and enhanced monitoring as compensating controls

Answer

When patching is not feasible, isolating the system via network segmentation and increasing monitoring reduces the attack surface and detection time.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Vulnerability Management 2