CySA+ Test Vulnerability Management 3

Question 1

Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for a vulnerability to be exploited, such as a race condition or a specific system state?

Accepted Answer

Attack Complexity

Answer

Attack Complexity (AC) captures prerequisite conditions outside attacker control — High AC means the attacker must meet additional circumstances like timing or configuration.

Question 2

What does a 'false negative' mean in the context of vulnerability scanning?

Accepted Answer

The scanner fails to detect a vulnerability that is actually present

Answer

A false negative is a missed detection — the real vulnerability exists on the target but the scanner does not flag it, often due to scan limitations or evasion.

Question 3

An organization scans its environment weekly but new vulnerabilities are continuously introduced through software deployments. Which process BEST addresses this gap?

Accepted Answer

Integrating vulnerability scanning into the CI/CD pipeline

Answer

Embedding scanning into CI/CD pipelines ensures every build is tested before it reaches production, addressing the gap that periodic scans miss newly deployed code.

Question 4

Which document formally records that an organization has acknowledged a vulnerability and chosen not to remediate it based on business justification?

Accepted Answer

Risk register entry with accepted risk notation

Answer

Accepted risks are documented in the risk register with the business owner's sign-off, providing an audit trail for why known vulnerabilities were not remediated.

Question 5

During a vulnerability assessment, the analyst finds an open service on port 8080 returning a banner that identifies an outdated web server version. What is the analyst's next BEST action?

Accepted Answer

Correlate the version with known CVEs and assess exploitability in context

Answer

Banner information identifies software version; the analyst should look up CVEs for that version and evaluate whether the vulnerability is exploitable given the environment.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Vulnerability Management 3