CySA+ Test Vulnerability Management 3 — Questions and Answers
Question 1: Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for a vulnerability to be exploited, such as a race condition or a specific system state?
- Privileges Required
- User Interaction
- Attack Complexity (Correct answer)
- Scope
Correct answer: Attack Complexity
Attack Complexity (AC) captures prerequisite conditions outside attacker control — High AC means the attacker must meet additional circumstances like timing or configuration.
Question 2: What does a 'false negative' mean in the context of vulnerability scanning?
- The scanner reports a vulnerability that does not actually exist
- The scanner fails to detect a vulnerability that is actually present (Correct answer)
- The scanner crashes during the scan
- The scanner reports a vulnerability with the wrong CVSS score
Correct answer: The scanner fails to detect a vulnerability that is actually present
A false negative is a missed detection — the real vulnerability exists on the target but the scanner does not flag it, often due to scan limitations or evasion.
Question 3: An organization scans its environment weekly but new vulnerabilities are continuously introduced through software deployments. Which process BEST addresses this gap?
- Increasing scan frequency to daily
- Integrating vulnerability scanning into the CI/CD pipeline (Correct answer)
- Requiring manual code reviews for all deployments
- Disabling automatic deployments until weekly scans complete
Correct answer: Integrating vulnerability scanning into the CI/CD pipeline
Embedding scanning into CI/CD pipelines ensures every build is tested before it reaches production, addressing the gap that periodic scans miss newly deployed code.
Question 4: Which document formally records that an organization has acknowledged a vulnerability and chosen not to remediate it based on business justification?
- Vulnerability exception request
- Remediation ticket
- Scan configuration baseline
- Risk register entry with accepted risk notation (Correct answer)
Correct answer: Risk register entry with accepted risk notation
Accepted risks are documented in the risk register with the business owner's sign-off, providing an audit trail for why known vulnerabilities were not remediated.
Question 5: During a vulnerability assessment, the analyst finds an open service on port 8080 returning a banner that identifies an outdated web server version. What is the analyst's next BEST action?
- Immediately shut down the service
- Correlate the version with known CVEs and assess exploitability in context (Correct answer)
- Report it as critical without further investigation
- Rescan the port to confirm the banner is accurate
Correct answer: Correlate the version with known CVEs and assess exploitability in context
Banner information identifies software version; the analyst should look up CVEs for that version and evaluate whether the vulnerability is exploitable given the environment.
Question 6: Which scanning technique sends specially crafted packets to elicit responses that reveal OS and service version information without authentication?
- Credentialed host scan
- Passive network monitoring
- Active fingerprinting (Correct answer)
- Fuzzing
Correct answer: Active fingerprinting
Active fingerprinting (e.g., Nmap OS detection) probes target systems with specific packets and analyzes responses to identify OS, services, and versions.
Question 7: A vulnerability management program reports that mean time to remediate (MTTR) critical vulnerabilities has increased from 7 days to 21 days over the past quarter. What is the MOST likely root cause to investigate first?
- The vulnerability scanner is generating more false positives
- The patch deployment process or change management workflow has a bottleneck (Correct answer)
- Critical vulnerabilities are being discovered less frequently
- The organization's risk appetite has changed
Correct answer: The patch deployment process or change management workflow has a bottleneck
An increasing MTTR typically signals a bottleneck in the patching or change management process — approvals, testing cycles, or resource constraints are slowing remediation.
CySA+ Test Vulnerability Management 3
Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for a vulnerability to be exploited, such as a race condition or a specific system state?