CCST Vulnerability Assessment Concepts 2 — Questions and Answers
Question 1: What is the primary difference between a vulnerability scan and a penetration test?
- No difference
- Scans identify known weaknesses automatically; pen tests actively exploit vulnerabilities to assess real-world risk (Correct answer)
- Pen tests are automated; scans are manual
- Scans are more expensive
Correct answer: Scans identify known weaknesses automatically; pen tests actively exploit vulnerabilities to assess real-world risk
Vulnerability scans are automated identification; pen tests are active exploitation by skilled testers.
Scans use tools like Nessus to check against CVE databases. Pen tests use attacker techniques including social engineering and custom exploits. Organizations typically scan weekly/monthly and pen test annually.
Question 2: What does CVSS measure?
- Financial cost of fixing a vulnerability
- Severity of a vulnerability scored from 0 to 10 based on exploitability and impact (Correct answer)
- Number of affected systems
- Time required to patch
Correct answer: Severity of a vulnerability scored from 0 to 10 based on exploitability and impact
CVSS rates severity using metrics including attack vector, complexity, privileges required, and CIA impact.
Base metrics: Attack Vector, Complexity, Privileges Required, User Interaction, Scope, CIA Impact. Severity: None (0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0).
Question 3: What is a false positive in vulnerability scanning?
- A correctly identified vulnerability
- A scan result incorrectly reporting a vulnerability that does not exist (Correct answer)
- A vulnerability that cannot be exploited
- A scan finding nothing
Correct answer: A scan result incorrectly reporting a vulnerability that does not exist
False positives report vulnerabilities not actually present, often from incorrect version detection or overly broad signatures.
Causes: version detection without checking backported patches, undetected compensating controls. Reduce with authenticated scans, policy tuning, and manual validation of high-severity findings.
Question 4: What is the purpose of asset inventory in vulnerability management?
- To calculate IT equipment cost
- To maintain a complete record of all systems so vulnerabilities can be identified across the entire environment (Correct answer)
- To determine which assets to sell
- To schedule hardware replacement
Correct answer: To maintain a complete record of all systems so vulnerabilities can be identified across the entire environment
Asset inventory ensures all hardware, software, and services are known so nothing is missed during scanning.
Includes hardware, software, cloud resources, and services. Unmanaged shadow IT often has the most vulnerabilities. CIS Controls 1 and 2 (Hardware and Software Asset Inventory) are first for this reason.
Question 5: What is risk prioritization in vulnerability management?
- Fixing all vulnerabilities simultaneously
- Ranking vulnerabilities by severity, asset criticality, threat intelligence, and business context to determine remediation order (Correct answer)
- Ignoring low-severity vulnerabilities
- Only addressing auditor-reported vulnerabilities
Correct answer: Ranking vulnerabilities by severity, asset criticality, threat intelligence, and business context to determine remediation order
Combines CVSS score, asset criticality, exploitation status, and business context to focus on greatest risks first.
A critical vuln on an isolated test server may pose less risk than a medium vuln on an internet-facing production system. Frameworks: SSVC, EPSS. Goal: maximize risk reduction per unit of effort.
Question 6: What is an authenticated vulnerability scan and why is it more accurate?
- A scan requiring CVSS authentication
- A scan that logs into targets with valid credentials to check patches and configurations from inside (Correct answer)
- A scan certified by a third party
- A scan checking only public-facing services
Correct answer: A scan that logs into targets with valid credentials to check patches and configurations from inside
Authenticated scans log into systems to examine installed software, patches, and configurations, reducing false positives and negatives.
Unauthenticated scans only see open ports and banners. Authenticated scans check actual patch levels, configurations, file permissions, and running services. Detect 5-10x more vulnerabilities. Use dedicated read-only service account.
CCST Vulnerability Assessment Concepts 2
What is the primary difference between a vulnerability scan and a penetration test?