Vulnerability Management Flashcards

Which of the following is a key characteristic of a zero-day vulnerability in PCI DSS contexts?

Answer: A flaw exploited before a vendor patch is available

A zero-day vulnerability is one that is being exploited in the wild before the vendor has released a patch to address it.

According to PCI DSS, who is qualified to perform internal vulnerability scans?

Answer: Qualified internal staff or qualified third parties (internal scans do not require ASV)

Internal vulnerability scans do not need to be performed by an ASV; they can be done by qualified internal personnel or qualified third parties.

A company's web application firewall (WAF) is being used as a compensating control for a vulnerability in a web-facing application. What must the WAF compensating control include?

Answer: Active monitoring and a defined rule set blocking exploitation of the specific vulnerability

A WAF used as a compensating control must be actively monitored and configured with rules that specifically prevent exploitation of the unpatched vulnerability.

What is the significance of CVE (Common Vulnerabilities and Exposures) identifiers in PCI DSS vulnerability management?

Answer: CVEs provide a standardized reference for publicly known vulnerabilities, aiding in consistent tracking

CVE identifiers provide a standardized naming convention for publicly known vulnerabilities, enabling consistent communication and tracking across organizations and tools.

Under PCI DSS Requirement 11, after a significant infrastructure change, when must an internal vulnerability scan be performed?

Answer: After the change is implemented

PCI DSS requires internal vulnerability scans to be performed after any significant changes to the network or system components.

Which of the following best describes the relationship between patch management and vulnerability management in PCI DSS?

Answer: Patch management is a subset of vulnerability management, addressing remediation through software updates

Patch management is a component of the broader vulnerability management program, focusing specifically on applying vendor-released fixes to address identified vulnerabilities.

An organization running cardholder data environment systems on a shared hosting provider—who is responsible for ensuring vulnerability scans meet PCI DSS requirements?

Answer: The merchant retains compliance responsibility but may rely on the provider's scans if documented

Merchants retain PCI DSS compliance responsibility even in shared hosting environments and must ensure scans meet requirements, whether performed by them or documented from the provider.