Vulnerability Management Flashcards

Under PCI DSS, how frequently must internal vulnerability scans be performed?

Answer: At least quarterly

PCI DSS Requirement 11.3.1 requires internal vulnerability scans to be performed at least quarterly.

Which CVSS score range is generally classified as 'Critical' severity?

Answer: 9.0–10.0

CVSS scores of 9.0–10.0 are classified as Critical, representing the highest severity vulnerabilities.

A merchant discovers a vulnerability that has a patch available but cannot immediately apply it due to operational constraints. What is the PCI DSS-compliant response?

Answer: Implement compensating controls and document the risk

When patching is delayed, merchants must implement compensating controls and document the associated risk per PCI DSS guidelines.

What is the primary purpose of a vulnerability scan compared to a penetration test?

Answer: Vulnerability scans identify potential weaknesses; penetration tests actively attempt to exploit them

Vulnerability scans detect and report potential security weaknesses, while penetration tests actively attempt to exploit those weaknesses to assess real impact.

Which PCI DSS requirement mandates that new vulnerabilities be identified and addressed within one month of discovery for high-risk vulnerabilities?

Answer: Requirement 6.3

PCI DSS Requirement 6.3 covers security vulnerability management, including addressing high-risk vulnerabilities within one month.

When an Approved Scanning Vendor (ASV) external scan returns a failing result, what must occur before the quarterly scan requirement is considered met?

Answer: Vulnerabilities must be remediated and a passing rescan completed

A failing ASV scan requires remediation of identified vulnerabilities followed by a successful rescan to satisfy the quarterly external scan requirement.

In the context of PCI DSS vulnerability management, what does 'risk ranking' of vulnerabilities help an organization achieve?

Answer: It prioritizes remediation efforts based on potential impact and exploitability

Risk ranking allows organizations to prioritize which vulnerabilities to remediate first based on factors like severity, exploitability, and potential business impact.