CCNA Cysa Vulnerability Management Questions

AV:N (Attack Vector: Network) means the vulnerable component is bound to the network stack and the attacker's path to exploit lies through a routable network connection, potentially even across the internet, rather than requiring physical or local access. This is the highest-severity attack vector value because it maximizes the pool of potential attackers, contributing to this vulnerability's near-maximum CVSS base score of 9.8 alongside low complexity and no required privileges or user interaction.

Implementing network segmentation isolates the vulnerable legacy application within a restricted network zone, such as a dedicated VLAN or DMZ. This control significantly reduces the attack surface by ensuring only authorized users and systems can communicate with the application, effectively mitigating the risk of lateral movement and unauthorized exploitation when no patch is available.

Validating patches within a dedicated staging environment that closely replicates the production architecture is a fundamental security best practice. This process allows administrators to identify compatibility issues, assess performance impacts, and ensure system stability before deploying the updates to live, mission-critical systems.

Running containers in privileged mode grants them every Linux capability, disables seccomp and AppArmor/SELinux confinement, and exposes all host devices, effectively removing isolation between the container and the host kernel. An attacker who exploits a vulnerability in a privileged container can trivially escalate to full host control, making it one of the most dangerous container misconfigurations. During a vulnerability assessment, this should immediately be flagged as a critical finding.

The vector's Availability metric is A:H, meaning High, the only impact metric set above None in this string, indicating the vulnerability can fully deny access to the affected resource, for example through a crash or resource exhaustion condition, making Availability the clear primary impact and consistent with a 7.5 base score driven almost entirely by this single high-impact metric.

Injection vulnerabilities occur when untrusted user input is interpreted as part of a command or query, leading to unauthorized execution. In OWASP frameworks, Cross-Site Scripting (XSS) is classified as a form of injection because malicious scripts are injected into trusted web applications to execute in the victim's browser.

Nessus is a commercial vulnerability scanner developed by Tenable that actively scans hosts and network services, comparing software versions and configurations against a comprehensive plugin database of known Common Vulnerabilities and Exposures (CVEs). It supports credentialed scans, agent-based scanning, and integration with patch management and SIEM platforms, making it a primary tool for continuous vulnerability management. This directly matches the goal of identifying exploitable weaknesses across an enterprise.

This is correct: the vector specifies S:C (Scope Changed) and C:H (high confidentiality impact), while integrity and availability are None (I:N/A:N). A Changed scope means the vulnerability affects resources outside the vulnerable component's security authority, and the only rated impact is disclosure of sensitive information. These values exactly match the analyst's finding.

Overly permissive RBAC bindings grant cluster-wide or wildcard permissions, letting a compromised workload escalate privileges or reach other namespaces. Auditing roles, ClusterRoleBindings and service accounts for excessive verbs and resources is a priority Kubernetes hardening check.

Asset criticality is the correct primary driver for prioritization because it directly captures the potential business impact if confidentiality, integrity, or availability is compromised. A vulnerability on a server that processes financial transactions or contains protected health information poses far greater risk than the same CVE on an internet-facing demo server with no sensitive data. This aligns with risk-based vulnerability management, where risk equals the likelihood of exploitation multiplied by the consequence to the business.

Privileged containers run with all Linux capabilities and disable isolation mechanisms such as seccomp, AppArmor, or SELinux, effectively granting the process root-equivalent access to the host kernel and devices. This means a malicious or compromised workload inside the container can directly attempt to escape the container and compromise the underlying node. Thus, enabling privileged mode is a critical misconfiguration that should be avoided in standard deployments.

A compensating control is an alternative safeguard put in place to mitigate risk when a primary security control, such as applying a vendor patch, is technically or operationally unfeasible. By configuring the Web Application Firewall to block exploits targeting the specific vulnerability, the organization successfully reduces the associated risk to an acceptable level without modifying the underlying application code.

Correct. Level 2 benchmarks apply defense-in-depth hardening intended for high-security environments and often disable features, ports, or services that could affect usability or compatibility, so CIS explicitly recommends testing Level 2 changes before production deployment due to potential functional impact.

Snyk scans container images for known vulnerabilities in OS packages and application dependencies, integrating into CI pipelines and registries. It is a widely adopted container image scanning tool, satisfying the selection criterion for this programme.

This option correctly synthesizes business context and risk-based vulnerability management. Because the asset is a non-production development server isolated from the internet, the actual risk of exploitation is significantly mitigated. Combining this low exposure with a low EPSS score justifies scheduling the patch during routine maintenance windows rather than disrupting operations with an emergency deployment.

Broken access control is the correct answer because it directly describes a failure to enforce restrictions on what authenticated users are allowed to do. By manipulating parameters, headers, or API endpoints in Burp Suite, testers can identify flaws like Insecure Direct Object References (IDOR) or privilege escalation, which allow unauthorized data access.

Incorporating both vulnerability severity and business context is fundamental to risk-based vulnerability management. Since the asset is non-critical and isolated from the internet, the overall risk is low despite a high EPSS score, making it appropriate to document the vulnerability and remediate it during the next scheduled maintenance window without disrupting business operations.

Server-Side Request Forgery is explicitly categorized as A10 in the OWASP Top 10 2021. This vulnerability occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to coerce the application into sending crafted requests to unexpected destinations, such as internal loopback addresses, metadata services, or private backend systems.

Testing patches in a staging environment replicates the production configuration, including operating system versions, middleware, and sample data, to validate patch behavior and compatibility before any disruption. It allows security and IT teams to detect conflicts, broken dependencies, and performance degradations early, and to develop rollback procedures. This process is foundational to a mature patch management lifecycle because it directly reduces the probability of production outages and security regressions.

Testing the patch in a staging environment that mirrors production is the correct first step because it allows you to verify the patch against the exact operating system versions, applications, and configurations that exist in your live environment. This phase catches compatibility issues, dependency breaks, and security policy conflicts before they reach critical systems. It also lets you validate rollback procedures and measure any performance impact in an isolated setting. Confirming stability in staging builds the evidence needed to support a change management approval and a confident production rollout.

CIS Level 1 profiles are designed to provide a baseline of essential security configurations that can be rapidly implemented. These recommendations are practical, prudent, and engineered to minimize any adverse impact on business operations or system performance.

Disabling directory listing on the web server prevents attackers from enumerating filenames and directory structure when no index file exists. Without this setting, requesting a directory returns a browsable list of all assets, exposing configuration backups, source code, or sensitive data. It is a core hardening step that reduces reconnaissance surface.

The Exploit Prediction Scoring System (EPSS) estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This data-driven metric allows analysts to prioritize high-probability threats immediately and decide whether to deploy rapid patches or implement temporary compensating controls.

AV:L confines the attacker to the local system, AC:H means conditions outside the attacker's control must align, PR:H demands administrative-level privileges beforehand, and UI:R requires a user to interact, matching every clause of this option exactly.

Trivy is a highly specialized, open-source vulnerability and misconfiguration scanner designed specifically for containers and other cloud-native targets. It excels at scanning container images, Git repositories, and Kubernetes configurations to detect OS package vulnerabilities and application dependency flaws directly within CI/CD pipelines.

The Exploit Prediction Scoring System (EPSS) is a data-driven model that estimates the probability, ranging from 0 to 1, that a software vulnerability will be exploited in the wild within the next 30 days. By combining real-world threat intelligence with machine learning, EPSS allows security analysts to prioritize remediation efforts based on actual threat likelihood rather than theoretical severity alone.

Segmenting scans by operating system allows the analyst to apply targeted credentials, which enables deep, authenticated configuration audits without generating excessive network noise. Implementing distinct scan windows and performance tuning prevents resource exhaustion on production servers and ensures that workstation scans do not disrupt business operations.

Modern vulnerability management relies on risk-based prioritization, which integrates threat intelligence, asset value, and vulnerability severity. EPSS provides a dynamic, data-driven estimate of exploit probability in the wild, which helps analysts filter out thousands of vulnerabilities that are unlikely to ever be leveraged. When combined with CVSS severity and internal asset criticality, EPSS enables security teams to allocate remediation resources to the highest-risk areas first.

Containers are designed to be immutable, meaning that patching a running instance directly is a major operational anti-pattern. The correct remediation workflow requires updating the Dockerfile or base image to a secure version, rebuilding the container image, and redeploying it to eliminate the vulnerabilities at their source.

Running a container in privileged mode grants it nearly all capabilities of the host's root user, disabling Linux namespaces and cgroups protections. When paired with a hostPath mount, an attacker can easily escape the container boundaries, access the host's sensitive system files, and execute arbitrary commands with root privileges on the underlying node.

The UI:N metric stands for User Interaction: None, which explicitly confirms that the vulnerability can be exploited without any active participation or assistance from a local user. This means the attack can be executed entirely out-of-band and automatically, making it highly dangerous compared to vulnerabilities requiring social engineering or user actions like clicking a link.

SQL injection lets an attacker insert untrusted input into a database query so it is executed as code rather than data, which is the exact definition of the OWASP Injection category and explains the payload and error message in the output.

The CIS Level 1 Benchmark is designed to deliver a basic, essential security posture that can be rapidly implemented across systems with minimal disruption to business operations. It focuses on disabling unnecessary services, configuring basic logging, and enforcing standard access controls without breaking application functionality. This makes it the ideal starting point for general enterprise configuration management.

Trivy scans container images for known vulnerabilities in OS packages and application dependencies, integrating into CI pipelines before deployment. This satisfies the requirement for a tool specifically designed for container image vulnerability scanning, unlike general-purpose scanners.

Effective vulnerability management requires aligning technical severity with business impact. Prioritizing remediation based on asset criticality ensures that high-value systems containing sensitive data or supporting mission-critical operations are patched first. Additionally, evaluating network exposure, such as whether an asset is internet-facing, helps security teams address the most immediate and viable attack vectors.

Removing the unused library directly eliminates the vulnerability from the container image, adhering to the principle of least utility and minimizing the attack surface. This approach prevents potential exploitation, reduces the overall image size, and streamlines future vulnerability scanning processes. It represents the most secure and efficient remediation strategy for unused dependencies.

Upgrading Apache Struts to the latest patched version is the primary remediation because it replaces the vulnerable code with a release that includes the security fix for the specific CVE. This action directly addresses the root cause of the flaw and eliminates the attack vector for known exploit patterns. Vendor patches are thoroughly tested and are the most reliable way to restore a secure state.

This finding maps directly to the CIS Benchmark recommendation that requires no world-writable files to exist in system directories, since files writable by any user create a path for unprivileged accounts or compromised processes to modify binaries, configuration files, or scripts that later run with elevated privileges.

OpenVAS, now maintained under the Greenbone Vulnerability Management project, is fully open-source and free to use, with a continuously updated feed of network vulnerability tests maintained by the community and Greenbone. It performs authenticated and unauthenticated network scans and is widely deployed by organizations that want scanning capability without commercial licensing costs.

The EPSS probability score is a data-driven metric from FIRST that estimates the likelihood a vulnerability will be exploited in the wild within 30 days. It is derived from real-world exploit data, CVE attributes, and threat intelligence, making it a strong indicator of active exploitation risk. As a correct prioritization input, it helps security teams focus on vulnerabilities that are most likely to be attacked, rather than just those with high theoretical severity. This is a valid and important factor for risk-based prioritization.

This CIS control checks bucket ACLs and bucket policies for statements granting access to 'Everyone' or 'AuthenticatedUsers' groups, which is precisely the misconfiguration exposing sensitive customer data, making it the check that flags and drives remediation of the finding.

Credentialed scans utilize valid administrative or user credentials to authenticate directly to the target system. This allows the scanner to query the local registry, inspect the file system, and query package managers to verify the exact patch levels and configuration settings. Consequently, this approach provides the most accurate assessment with minimal false positives.

Scope (S) is a correct base metric in CVSS v3.1, measuring whether a vulnerability in one vulnerable component can impact resources beyond its security scope. A changed scope indicates that exploitation may affect other components, increasing the overall severity. OpenVAS includes Scope in the base vector, so it is a valid base metric.

A privileged container runs with nearly all Linux capabilities enabled and direct access to host devices, meaning a compromised container can mount the host filesystem, load kernel modules, and effectively break out of container isolation entirely, giving an attacker root-equivalent control over the underlying node.

Asset criticality and business context are central to vulnerability prioritization because they determine the potential impact on operations, data confidentiality, and compliance. A critical internet-facing server, for example, represents a higher risk to the organization if compromised, even when the vulnerability's severity is moderate. Contextual factors such as exposure, sensitive data, and required availability turn a generic technical finding into a prioritized business risk.

The Attack Vector (AV) metric represents the context in which vulnerability exploitation is possible. A value of AV:N (Network) explicitly indicates that the vulnerability is exploitable remotely over the network, meaning the attacker does not need local, physical, or adjacent network access to compromise the target.

This combination represents the highest remediation priority because the CISA KEV catalog confirms the vulnerability is currently being exploited in the wild, while a high EPSS score mathematically predicts a high probability of imminent exploitation. Leveraging both threat-centric metrics allows security analysts to transition from theoretical severity to active risk-based patching.

Disclosing internal IP addresses in HTTP headers is typically classified as a medium-risk vulnerability that facilitates external reconnaissance. Remediation involves modifying the web server configuration to prevent the disclosure, which is a non-emergency change that should be scheduled during a standard maintenance window to avoid service disruption.

Combining the Exploit Prediction Scoring System (EPSS) and CISA's Known Exploited Vulnerabilities (KEV) catalog allows analysts to focus on threats with active, real-world exploitation activity. Integrating business context ensures that remediation efforts are directed toward high-value assets that directly impact organizational operations. This risk-based approach optimizes resource allocation and significantly reduces actual organizational exposure compared to relying solely on static severity scores.

Exposure determines the likelihood of attack, considering whether the asset is internet-facing or reachable by potential adversaries. It directly influences the probability of exploitation, making it a fundamental factor in prioritizing vulnerabilities. Without exposure, even a critical vulnerability on an internal system poses less immediate risk. Therefore, asset exposure is the primary determinant for prioritizing remediation efforts.

Every metric matches the scenario exactly: AV:N reflects remote network exploitability, AC:L means no special conditions are needed, PR:N and UI:N confirm no authentication or victim action is required, and C:H/I:H/A:H capture the total loss of confidentiality, integrity, and availability, which together drive the 9.8 critical base score.

Correct. AV:N indicates the vulnerability is exploitable remotely over a network without requiring physical or adjacent access, and S:U means the exploited component's impact stays confined within its own security scope rather than affecting resources managed by a different authority.

Running containers with privileged access essentially grants them the same capabilities as the host root user, bypassing container isolation boundaries. CIS Kubernetes benchmarks strongly recommend disabling privileged containers to prevent container breakout attacks, where an attacker compromises a container and escalates privileges to compromise the underlying node.

During the testing phase of patch management, regression testing is essential to confirm that the newly applied software update does not break or degrade existing system functionalities, APIs, or custom integrations. This systematic validation ensures that while the security vulnerability is successfully mitigated, the operational stability of the application or operating system remains fully intact before deployment.

SQL injection is a runtime vulnerability that DAST tools are highly effective at identifying. By actively injecting malicious payloads into input fields, query parameters, and headers, the DAST scanner analyzes the application's HTTP responses and database error messages to confirm the vulnerability. This black-box testing closely mimics the behavior of an external attacker.

The CIS Level 1 profile is specifically designed to provide a basic, highly effective reduction of an organization's attack surface while minimizing disruption to business operations and system utility. These consensus-based recommendations can be rapidly implemented across an enterprise without causing significant compatibility issues or administrative overhead.

This approach aligns with best-practice vulnerability management by balancing the need for security against operational availability. A compensating control, such as an internal network access control list (ACL) or an updated intrusion prevention system (IPS) signature, reduces the likelihood or impact of exploitation until the patch can be installed during a scheduled maintenance window. This ensures that the system remains functional and that the patch is tested and deployed in a controlled manner, minimizing downtime and the risk of unexpected failures. It is the correct decision because it addresses the vulnerability without disproportionate disruption to the business.

CIS Level 1 benchmarks are meticulously designed to establish a foundational security posture across various systems without significantly disrupting business operations or demanding extensive resources. These basic security configurations focus on essential hardening steps that are broadly applicable and easy to implement, ensuring a robust security baseline can be achieved with minimal risk of system instability or performance degradation. This approach makes them highly practical for widespread adoption.

The vulnerability with a CVSS score of 5.0 should be prioritized because its high EPSS score and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog indicate active, real-world exploitation. Remediation efforts must focus on vulnerabilities with proven threat actor activity, as they represent an immediate entry point, regardless of a moderate base severity score.

Lynis is an open-source, battle-tested security auditing tool specifically designed for Unix-like operating systems, including Linux and macOS. It runs locally on the host to perform deep scans of system configurations, bootloaders, kernel parameters, and installed packages, providing actionable hardening recommendations to improve overall system defense.

Lynis is an open-source, host-based security auditing tool specifically engineered for Unix, Linux, and macOS systems. It conducts deep local scans to evaluate system hardening, detect configuration flaws, and verify compliance with frameworks like PCI-DSS and ISO 27001. Unlike network scanners, it runs directly on the target operating system to inspect local configuration files and system parameters.

The Exploit Prediction Scoring System (EPSS) is a data-driven model that estimates the probability that a specific vulnerability will be exploited in the wild within the next 30 days. By integrating real-time threat intelligence and historical exploit data, EPSS allows security analysts to prioritize remediation efforts based on actual threat activity rather than theoretical severity alone.

OpenSCAP is an open-source security compliance tool designed specifically to audit systems against standardized security baselines, such as the Center for Internet Security (CIS) benchmarks and DISA STIGs. It utilizes the Security Content Automation Protocol (SCAP) to automate configuration compliance checking and vulnerability assessment, making it the ideal choice for verifying adherence to specific security frameworks.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a worst-case scenario where an unauthenticated remote attacker can fully compromise confidentiality, integrity, and availability without user interaction. Because the Scope is Unchanged (S:U), the mathematical formula caps the maximum possible base score at 9.8 rather than 10.0.

Level 1 controls, such as disabling unused filesystems or setting basic password policies, are designed to reduce the attack surface without breaking common applications, making them suitable as a default baseline for nearly any server.

Because the unvalidated URL parameter is used server-side to fetch a resource, an attacker can substitute internal addresses, cloud metadata endpoints, or restricted URLs, forcing the server itself to issue requests it controls, which is the defining behavior of Server-Side Request Forgery.

Verification is the closing phase of the lifecycle, where the analyst re-scans or otherwise re-tests the previously vulnerable asset to confirm the remediation was applied correctly and the vulnerability no longer exists, closing the loop before the finding can be marked resolved in the tracking system.

hostPath mounts bind a node's filesystem directory into a pod, breaking container isolation. A compromised pod can then read or write node files, including credentials and the kubelet configuration, escalating beyond its namespace and undermining the cluster's security boundary.

CIS Benchmarks define Level 1 as the core set of security configurations that can be implemented without significantly degrading system functionality or causing incompatibility, making them suitable for most environments. Level 2 extends these settings with more aggressive hardening, such as disabling legacy protocols or tightening file permissions, which may reduce performance, break existing workflows, or require additional operational overhead. This performance-versus-restriction trade-off is the intended distinction.

Injection occurs when untrusted user input is directly interpreted as code by an interpreter. Cross-Site Scripting (XSS) is a specific type of injection vulnerability where malicious scripts are injected into benign and trusted websites. During an OWASP ZAP assessment, the tool identifies this by injecting payload strings and verifying if they execute within the context of the victim's browser session.

Validating the patch in a dedicated staging environment that replicates production configurations allows administrators to identify potential software conflicts, performance degradation, or deployment failures. This isolated testing ensures that the update can be safely applied to production systems without disrupting critical business operations.

Configuration drift is the gradual and often unnoticed deviation of a system's current configuration from its intended, documented baseline. It results from incremental changes such as manual edits, emergency fixes, unpatchable workarounds, or inconsistent patch deployments that accumulate over time without change-control approval. This divergence can lead to security weaknesses, compliance violations, and unpredictable behavior, making it a central concern for configuration management.

Credentialed scans utilize valid administrative or user credentials to log directly into target systems, enabling the scanner to inspect local registries, installed software versions, and configuration files. This deep visibility allows for the identification of missing patches and misconfigurations that are invisible from the network perspective, minimizing false positives and negatives.

The standard operating procedure when finding a regression during patch testing is to document the defect and report it to the software vendor. This allows the vendor to refactor the code and release an updated, stable patch. While waiting, the organization should implement compensating controls to mitigate the underlying vulnerability without breaking production systems.

Correct. OpenSCAP is built specifically around SCAP standards, consuming XCCDF checklists and OVAL definitions to evaluate a system's actual configuration against CIS Benchmarks or DISA STIGs and producing pass/fail compliance results, which is its primary design purpose.