Vulnerability Management practice questions

Internet exposure of the affected asset

External reachability increases likelihood of attack.

Known exploitation in the wild

Active exploitation increases urgency.

Business criticality of the affected service

Impact depends on the service supported by the asset.

The asset supports a critical business process

Business impact increases priority.

The affected asset is internet-facing

External exposure increases attack opportunity.

Exploitation is observed in the wild

Active exploitation increases likelihood.

Confirm the firmware or software version on the device

Version evidence verifies whether the vulnerable build is present.

Check vendor advisory applicability and configuration requirements

Some findings depend on enabled features or specific configurations.

Business justification for delayed remediation

Justification explains why normal remediation cannot occur.

Expiration or review date

Time limits prevent exceptions becoming permanent by default.

Compensating controls

Controls reduce risk while the vulnerability remains.

Payload persists and executes when another user views the affected page

Stored execution against another user validates impact.

The vulnerable parameter and output encoding context are identified

Context shows why the payload executes.

SBOM generation and review for released builds

SBOMs support dependency tracking and downstream risk review.

Software composition analysis with policy gates

SCA identifies dependency CVEs before deployment.

Approval and rationale for the severity change

Governed downgrades need documented justification.

Evidence that the affected feature or code path is not reachable

Reachability evidence supports risk adjustment.

Authenticated access to inspect installed packages

Local package state usually requires credentials.

Scanner account permissions sufficient for inventory commands

The account must read package and configuration data.

Test the patch in a representative staging environment

Testing reduces outage risk.

Apply temporary compensating controls while preparing deployment

Controls reduce exposure if patching cannot be immediate.

Recently remediated findings awaiting validation

This shows work completed but not yet verified.

Open critical findings past SLA by owner

This shows accountability for overdue risk.

Use approved safe-check profiles or passive discovery where required

Non-intrusive methods reduce disruption risk.

Coordinate test windows and scope with OT owners

OT environments require strict change and safety coordination.

CMDB or asset inventory with business service mapping

Service mapping links technical assets to business impact.

Data classification or sensitivity labels for hosted data

Sensitive data increases impact.

Whether sensitive objects were accessed or downloaded

Access evidence supports impact assessment.

Whether public access is effectively allowed by bucket and account policies

Effective permissions determine exposure.

Lifecycle tracking for end-of-support dates

Lifecycle visibility enables proactive replacement.

Migration plan with business owner accountability

Unsupported software needs ownership and retirement planning.

Validate the WAF rule against bypass and false-positive risk

Compensating controls need effectiveness testing.

Track the vulnerability until the underlying flaw is fixed

A WAF is a compensating control, not a permanent fix.

Patch or mitigate the VPN appliance immediately and verify exposure is removed

Internet exposure plus active exploitation makes this the highest-risk item despite other findings.

Run authenticated scans using least-privilege scanner credentials

Authenticated scanning gives the scanner access to installed software and patch state, improving accuracy.

Manually test the service with a TLS client or scanner profile that negotiates protocol versions

Direct protocol validation determines whether TLS 1.0 is actually accepted.

Validate exploitability and rebuild from a patched base image where feasible

Container findings should consider reachability, but rebuilding from a patched base reduces inherited risk.

Restrict public access and determine whether sensitive data was accessed

The priority is exposure containment and impact assessment.