CCNA Vulnerability Management Questions

AV:N (Attack Vector: Network) means the vulnerable component is bound to the network stack and the attacker's path to exploit lies through a routable network connection, potentially even across the internet, rather than requiring physical or local access. This is the highest-severity attack vector value because it maximizes the pool of potential attackers, contributing to this vulnerability's near-maximum CVSS base score of 9.8 alongside low complexity and no required privileges or user interaction.

Running containers in privileged mode grants them every Linux capability, disables seccomp and AppArmor/SELinux confinement, and exposes all host devices, effectively removing isolation between the container and the host kernel. An attacker who exploits a vulnerability in a privileged container can trivially escalate to full host control, making it one of the most dangerous container misconfigurations. During a vulnerability assessment, this should immediately be flagged as a critical finding.

Nessus is a commercial vulnerability scanner developed by Tenable that actively scans hosts and network services, comparing software versions and configurations against a comprehensive plugin database of known Common Vulnerabilities and Exposures (CVEs). It supports credentialed scans, agent-based scanning, and integration with patch management and SIEM platforms, making it a primary tool for continuous vulnerability management. This directly matches the goal of identifying exploitable weaknesses across an enterprise.

This is correct: the vector specifies S:C (Scope Changed) and C:H (high confidentiality impact), while integrity and availability are None (I:N/A:N). A Changed scope means the vulnerability affects resources outside the vulnerable component's security authority, and the only rated impact is disclosure of sensitive information. These values exactly match the analyst's finding.

Excessive permissions in Kubernetes can lead to privilege escalation or unauthorized access.

Asset criticality is the correct primary driver for prioritization because it directly captures the potential business impact if confidentiality, integrity, or availability is compromised. A vulnerability on a server that processes financial transactions or contains protected health information poses far greater risk than the same CVE on an internet-facing demo server with no sensitive data. This aligns with risk-based vulnerability management, where risk equals the likelihood of exploitation multiplied by the consequence to the business.

Privileged containers run with all Linux capabilities and disable isolation mechanisms such as seccomp, AppArmor, or SELinux, effectively granting the process root-equivalent access to the host kernel and devices. This means a malicious or compromised workload inside the container can directly attempt to escape the container and compromise the underlying node. Thus, enabling privileged mode is a critical misconfiguration that should be avoided in standard deployments.

Snyk provides container scanning and vulnerability management.

Confidentiality (C) is one of the three core impact metrics in the CVSS base score, assessing the degree of unauthorized information disclosure that results from an exploit. It measures the impact on data privacy, where a rating of High means complete loss of confidentiality, such as exposing sensitive user credentials or protected records. This metric directly reflects the impact on the CIA triad's confidentiality component, making it a valid impact metric.

Testing patches in a staging environment replicates the production configuration, including operating system versions, middleware, and sample data, to validate patch behavior and compatibility before any disruption. It allows security and IT teams to detect conflicts, broken dependencies, and performance degradations early, and to develop rollback procedures. This process is foundational to a mature patch management lifecycle because it directly reduces the probability of production outages and security regressions.

Testing the patch in a staging environment that mirrors production is the correct first step because it allows you to verify the patch against the exact operating system versions, applications, and configurations that exist in your live environment. This phase catches compatibility issues, dependency breaks, and security policy conflicts before they reach critical systems. It also lets you validate rollback procedures and measure any performance impact in an isolated setting. Confirming stability in staging builds the evidence needed to support a change management approval and a confident production rollout.

Disabling directory listing on the web server prevents attackers from enumerating filenames and directory structure when no index file exists. Without this setting, requesting a directory returns a browsable list of all assets, exposing configuration backups, source code, or sensitive data. It is a core hardening step that reduces reconnaissance surface.

SQL injection is an injection flaw that occurs when untrusted data is directly concatenated into SQL queries, allowing attackers to manipulate database logic. For example, an attacker can submit a value like `' OR '1'='1` to bypass authentication or extract sensitive data. This happens because user input is not parameterized or properly sanitized before being sent to the database interpreter.

Trivy is purpose-built for container scanning.

Upgrading Apache Struts to the latest patched version is the primary remediation because it replaces the vulnerable code with a release that includes the security fix for the specific CVE. This action directly addresses the root cause of the flaw and eliminates the attack vector for known exploit patterns. Vendor patches are thoroughly tested and are the most reliable way to restore a secure state.

The EPSS probability score is a data-driven metric from FIRST that estimates the likelihood a vulnerability will be exploited in the wild within 30 days. It is derived from real-world exploit data, CVE attributes, and threat intelligence, making it a strong indicator of active exploitation risk. As a correct prioritization input, it helps security teams focus on vulnerabilities that are most likely to be attacked, rather than just those with high theoretical severity. This is a valid and important factor for risk-based prioritization.

Scope (S) is a correct base metric in CVSS v3.1, measuring whether a vulnerability in one vulnerable component can impact resources beyond its security scope. A changed scope indicates that exploitation may affect other components, increasing the overall severity. OpenVAS includes Scope in the base vector, so it is a valid base metric.

Asset criticality and business context are central to vulnerability prioritization because they determine the potential impact on operations, data confidentiality, and compliance. A critical internet-facing server, for example, represents a higher risk to the organization if compromised, even when the vulnerability's severity is moderate. Contextual factors such as exposure, sensitive data, and required availability turn a generic technical finding into a prioritized business risk.

Exposure determines the likelihood of attack, considering whether the asset is internet-facing or reachable by potential adversaries. It directly influences the probability of exploitation, making it a fundamental factor in prioritizing vulnerabilities. Without exposure, even a critical vulnerability on an internal system poses less immediate risk. Therefore, asset exposure is the primary determinant for prioritizing remediation efforts.

This approach aligns with best-practice vulnerability management by balancing the need for security against operational availability. A compensating control, such as an internal network access control list (ACL) or an updated intrusion prevention system (IPS) signature, reduces the likelihood or impact of exploitation until the patch can be installed during a scheduled maintenance window. This ensures that the system remains functional and that the patch is tested and deployed in a controlled manner, minimizing downtime and the risk of unexpected failures. It is the correct decision because it addresses the vulnerability without disproportionate disruption to the business.

CIS Level 1 benchmarks are meticulously designed to establish a foundational security posture across various systems without significantly disrupting business operations or demanding extensive resources. These basic security configurations focus on essential hardening steps that are broadly applicable and easy to implement, ensuring a robust security baseline can be achieved with minimal risk of system instability or performance degradation. This approach makes them highly practical for widespread adoption.

Cross-site scripting (XSS): XSS is a client-side injection vulnerability where an attacker injects malicious scripts into pages viewed by other users, enabling session hijacking, defacement, or credential theft. Burp Suite is highly effective at detecting XSS because its scanner automatically probes inputs with XSS payloads and its Intercepting Proxy allows manual testing of request/response pairs to confirm sanitization gaps. Since XSS appears in reflected, stored, and DOM-based forms and is pervasive in web applications, it is a classic vulnerability that Burp identifies with high confidence.

hostPath mounts allow container access to host filesystem.

CIS Benchmarks define Level 1 as the core set of security configurations that can be implemented without significantly degrading system functionality or causing incompatibility, making them suitable for most environments. Level 2 extends these settings with more aggressive hardening, such as disabling legacy protocols or tightening file permissions, which may reduce performance, break existing workflows, or require additional operational overhead. This performance-versus-restriction trade-off is the intended distinction.

Configuration drift is the gradual and often unnoticed deviation of a system's current configuration from its intended, documented baseline. It results from incremental changes such as manual edits, emergency fixes, unpatchable workarounds, or inconsistent patch deployments that accumulate over time without change-control approval. This divergence can lead to security weaknesses, compliance violations, and unpredictable behavior, making it a central concern for configuration management.

The A component of the CVSS v3.1 vector is H, which is the Availability Impact metric and indicates that the exploit can cause a total loss of availability, such as a denial of service. Unlike the C and I metrics, which are both N, the A metric is the only one rated high, so this option correctly identifies the finding's high impact on availability.

Attack Vector (AV) is a base metric that describes the context by which a vulnerability can be exploited, such as network, adjacent, local, or physical. This metric directly influences the CVSS exploitability subscore and is fundamental because it determines the remote vs. local nature of the attack. A network attack vector is typically the most severe because it allows exploitation from anywhere on the internet without prior access.

Applying a workaround as a compensating control is the most appropriate immediate action when a critical vulnerability is discovered and a vendor patch is not yet available. A compensating control is an alternative security measure that reduces the risk to an acceptable level until a permanent solution can be implemented. This approach effectively mitigates the immediate threat without causing undue operational disruption, balancing security with business continuity.

HostPath mounts allow a pod to mount an arbitrary path from the underlying node's filesystem directly into the container. Without restrictions such as requiring read-only mounts, allowing only specific directories, or disabling hostPath when possible, a compromised container can read or modify sensitive host files, plant malicious executables, or even achieve full node compromise. This is a critical misconfiguration that directly exposes the host and is absolutely a security risk.

Trivy is an open-source, fast, and comprehensive vulnerability scanner designed specifically for container images. It scans both OS packages (e.g., Alpine, Debian) and application dependencies (e.g., Python, Node.js) by comparing against a continuously updated CVE database, and it can be easily embedded into CI/CD pipelines with a simple CLI without requiring a separate server. Its low false-positive rate and support for multiple input formats (e.g., Docker, Podman, OCI) make it the most straightforward and effective choice among these options for the security team's container scanning need.

Broken Object Level Authorization (BOLA) is the most direct and correct answer because it occurs when an API fails to enforce per-object permissions, allowing an attacker to access, modify, or delete another user's data simply by substituting an object ID in an API request. For example, changing 'GET /api/user/123' to 'GET /api/user/456' can expose another user's private information if the server does not verify that the authenticated principal owns the requested object. This flaw is specifically catalogued as API1:2019 in the OWASP API Top 10 and is a primary focus of API penetration testing.

Emergency patching is a specialized, expedited process designed to rapidly deploy critical security updates to production systems, often bypassing standard testing and change management protocols due to the severe and immediate risk posed by a newly discovered vulnerability. Its primary objective is to quickly mitigate an active threat or prevent imminent exploitation, prioritizing risk reduction over typical operational considerations like extensive pre-deployment testing or scheduled maintenance windows. This approach is reserved for vulnerabilities deemed critical enough to warrant immediate action.

Setting password expiration to 90 days aligns with CIS Level 1 recommendations because it is a fundamental, low-impact security control that requires minimal configuration via PAM or Group Policy. It directly mitigates risk by limiting the window of opportunity for an attacker who has compromised a credential, ensuring that stolen passwords become invalid within a defined period. This setting rarely breaks applications or user workflows, making it a textbook Level 1 baseline requirement.

Implementing a web application firewall (WAF) rule (e.g., using the OWASP Core Rule Set) immediately blocks known XSS payloads at the edge, providing a temporary mitigation that reduces exploitability without taking the application offline. The WAF can be tuned to inspect query strings, POST bodies, and headers for attack signatures, allowing the security team to protect users while the development team prepares a permanent patch. This is a standard first-line response for web vulnerabilities, but the WAF rule should be considered a compensating control, not a substitute for secure coding.

CVSS is a standardized severity score that synthesizes exploitability characteristics (attack vector, attack complexity, privileges required, user interaction) and impact metrics (confidentiality, integrity, availability) into a 0–10 score. In v3.x, this score provides the critical first filter for triage, allowing an analyst to quickly separate low-severity flaws from those that demand immediate attention. However, it is only a measure of intrinsic severity, not a guarantee of real-world exploitation, so it must be combined with threat likelihood and business impact. As a severity benchmark, it remains the primary initial factor in any prioritization workflow.

In the Common Vulnerability Scoring System (CVSS), an Attack Vector of Network (AV:N) means the vulnerability is exploitable from any remote system that can reach the target over a network connection. This includes sending specially crafted IP packets, protocol-specific requests, or application-layer payloads without requiring any prior authentication or local access. The attacker does not need to be co-located on the target's local subnet, merely capable of network connectivity.

Stored XSS in the comment section is an injection vulnerability because the attacker injects executable client-side script (e.g., JavaScript) that is persisted on the server and later rendered in other users' browsers. Unlike SQL injection, which targets the database layer with structured query language, XSS targets the interpretation context of HTML/JavaScript in the victim's browser. The comment field fails to sanitize or encode user input, enabling script execution that can steal session cookies, deface pages, or perform actions on behalf of the target user.

An out-of-band (OAST) SSRF test uses an external callback server like Burp Collaborator to detect when the application fetches an attacker-specified URL. If a DNS lookup or HTTP hit is received, it proves the server-side component is making the request as the victim, even when the response body is not reflected to the tester. This technique is essential for blind SSRF, where the application processes the response internally without echoing it back. It also confirms the vulnerability independently of any firewall or filtering on the inbound path.

The CVSS vector string 'AC:L' explicitly denotes a Low Attack Complexity. This means that a successful attack does not require specialized conditions beyond the attacker's control, nor does it demand extensive preparation or specific timing. Attackers can typically exploit such vulnerabilities with readily available techniques and resources, making the attack relatively straightforward and increasing its likelihood.

The KEV catalog includes a 'Date Added' field that records when a vulnerability was first identified as known exploited, allowing security teams to prioritize based on how recent and relevant the active exploitation is. This date is crucial because newer entries often warrant immediate attention, as attackers may be actively leveraging them. In contrast to CVSS or EPSS scores, this date is a distinct component of the KEV record itself, making it the right field when consulting the catalog for prioritization.