CVA Reporting Findings & Compliance Standards 2 — Questions and Answers
Question 1: Which risk rating system uses a 0–10 numeric score to prioritize vulnerability severity in assessment reports?
- CVSS (Common Vulnerability Scoring System) (Correct answer)
- OWASP Risk Rating Methodology
- DREAD model
- STRIDE model
Correct answer: CVSS (Common Vulnerability Scoring System)
CVSS provides a standardized 0–10 numeric score that helps organizations prioritize remediation based on vulnerability severity.
Question 2: In a vulnerability assessment report, the 'executive summary' section is primarily intended for which audience?
- IT administrators responsible for patching
- C-suite and non-technical decision makers (Correct answer)
- Penetration testers reviewing methodology
- Compliance auditors checking control effectiveness
Correct answer: C-suite and non-technical decision makers
The executive summary conveys high-level risk posture and business impact to senior leadership who may lack technical backgrounds.
Question 3: Under PCI DSS, how frequently must internal vulnerability scans be performed at minimum?
- Annually
- Every six months
- Quarterly (Correct answer)
- Monthly
Correct answer: Quarterly
PCI DSS Requirement 11.3 mandates internal vulnerability scans at least quarterly to maintain cardholder data environment security.
Question 4: Which report element describes the specific steps taken to discover a vulnerability, enabling the reader to reproduce findings?
- Risk rating matrix
- Proof of concept
- Remediation roadmap
- Methodology section (Correct answer)
Correct answer: Methodology section
The methodology section documents tools, techniques, and scope applied during the assessment so findings can be validated and reproduced.
Question 5: A vulnerability assessor must report a critical finding to a client mid-engagement that could allow immediate data exfiltration. What is the best course of action?
- Wait until the final report is complete to avoid alarm
- Issue an out-of-band verbal or written notification immediately (Correct answer)
- Exploit the vulnerability to demonstrate impact before notifying
- Patch the vulnerability yourself without notifying the client
Correct answer: Issue an out-of-band verbal or written notification immediately
Critical findings with immediate business risk require prompt out-of-band notification rather than waiting for the final deliverable.
Question 6: HIPAA's Security Rule requires covered entities to conduct which type of ongoing activity that directly informs vulnerability reporting?
- Annual penetration testing
- Continuous risk analysis (Correct answer)
- Quarterly firewall reviews
- Monthly access recertification
Correct answer: Continuous risk analysis
HIPAA §164.308(a)(1) mandates ongoing risk analysis to identify threats and vulnerabilities to ePHI, feeding into remediation reporting.
Question 7: Which CVSS v3.1 metric captures whether an attacker needs to exploit a secondary system to reach the vulnerable component?
- Attack Vector
- Privileges Required
- Scope (Correct answer)
- User Interaction
Correct answer: Scope
The Scope metric indicates whether a vulnerability can impact components beyond the vulnerable component's security authority.
CVA Reporting Findings & Compliance Standards 2
Which risk rating system uses a 0–10 numeric score to prioritize vulnerability severity in assessment reports?