Vulnerability Management practice questions

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

Trap 1: Ignore the finding because the scanner is clearly wrong

The package is present, so the finding should not be dismissed without documentation, validation, and risk review.

Trap 2: Reinstall the disabled plugin so the scanner output matches the…

Reinstalling the plugin would increase exposure instead of reducing risk, even if it satisfied the scan result visually.

Trap 3: Expose the server to the internet for faster monitoring and patch…

Placing the server on the internet would significantly increase risk and is not a valid remediation strategy.

A
Ignore the finding because the scanner is clearly wrong
Why wrong: The package is present, so the finding should not be dismissed without documentation, validation, and risk review.
B
Create a time-limited exception and apply compensating controls until patching is possible
A temporary exception with compensating controls balances business constraints and security while the team schedules a proper fix.
C
Reinstall the disabled plugin so the scanner output matches the running configuration
Why wrong: Reinstalling the plugin would increase exposure instead of reducing risk, even if it satisfied the scan result visually.
D
Expose the server to the internet for faster monitoring and patch testing
Why wrong: Placing the server on the internet would significantly increase risk and is not a valid remediation strategy.

Read the full Vulnerability Management explanation →

Question 2mediummultiple choice

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

Trap 1: Close the finding as fixed because the reverse proxy reduces the…

The issue is not actually fixed in the vulnerable component, even if the proxy reduces exposure.

Trap 2: Mark the finding as a false positive and remove it from future scans

The scanner is detecting a real configuration issue, so it should not be dismissed as a false positive.

Trap 3: Ignore the finding until the vendor releases a new version

Ignoring the issue leaves the organization without accountability, tracking, or a documented risk decision.

A
Close the finding as fixed because the reverse proxy reduces the risk
Why wrong: The issue is not actually fixed in the vulnerable component, even if the proxy reduces exposure.
B
Record an exception, document the compensating control, and set a review or remediation date
An exception with documented mitigation and follow-up keeps the risk visible and tracked until the underlying issue can be remediated.
C
Mark the finding as a false positive and remove it from future scans
Why wrong: The scanner is detecting a real configuration issue, so it should not be dismissed as a false positive.
D
Ignore the finding until the vendor releases a new version
Why wrong: Ignoring the issue leaves the organization without accountability, tracking, or a documented risk decision.

Read the full Vulnerability Management explanation →

Question 3easymultiple choice

A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?

Trap 1: Default credentials

Default credentials are a separate issue involving unchanged vendor usernames or passwords. The scan result here says nothing about the account password.

Trap 2: Outdated component

An outdated component would mean the software version is end-of-life or missing patches. The clue here is network exposure, not software age.

Trap 3: Weak permissions

Weak permissions usually refer to file, folder, or object access controls. The problem in this question is that the management service is reachable too broadly.

A
Exposed management service
This is the correct answer because the admin SSH service is reachable on all interfaces instead of being limited to the internal management network. That increases attack surface and allows unauthorized internet exposure if firewall rules are weak or missing. The problem is the service placement and exposure, not the SSH protocol itself.
B
Default credentials
Why wrong: Default credentials are a separate issue involving unchanged vendor usernames or passwords. The scan result here says nothing about the account password.
C
Outdated component
Why wrong: An outdated component would mean the software version is end-of-life or missing patches. The clue here is network exposure, not software age.
D
Weak permissions
Why wrong: Weak permissions usually refer to file, folder, or object access controls. The problem in this question is that the management service is reachable too broadly.

Question 4mediummultiple choice

A security analyst is reviewing the session management implementation of a web application. The application generates session tokens by computing the MD5 hash of the concatenation of the username and the current server timestamp rounded to the nearest hour. An attacker has obtained a valid session token for her own account and discovers that she can forge tokens for other users by simply substituting the username in the hash calculation with a known target username. Which type of attack is the web application most vulnerable to?

Trap 1: Session hijacking via cross-site scripting (XSS)

Session hijacking via XSS requires an attacker to inject malicious script that steals the victim's session token. This scenario does not involve injecting script; it involves predicting the token without stealing it.

Trap 2: Session replay attack

A session replay attack involves capturing a valid token and reusing it later to impersonate the same user. The vulnerability described allows the attacker to create a token for a different user, not replay a captured one.

Trap 3: Session fixation

Session fixation occurs when an attacker forces a victim to use a session token that the attacker knows. Here, the attacker is able to compute a token for the victim without any interaction, so it is prediction, not fixation.

A
Session hijacking via cross-site scripting (XSS)
Why wrong: Session hijacking via XSS requires an attacker to inject malicious script that steals the victim's session token. This scenario does not involve injecting script; it involves predicting the token without stealing it.
B
Session replay attack
Why wrong: A session replay attack involves capturing a valid token and reusing it later to impersonate the same user. The vulnerability described allows the attacker to create a token for a different user, not replay a captured one.
C
Session prediction
The session token is generated using the username and a timestamp with low granularity, making it possible for an attacker who knows the algorithm to calculate valid tokens for any user. This is a classic session prediction vulnerability.
D
Session fixation
Why wrong: Session fixation occurs when an attacker forces a victim to use a session token that the attacker knows. Here, the attacker is able to compute a token for the victim without any interaction, so it is prediction, not fixation.

Read the full Vulnerability Management explanation →

Question 5mediummultiple choice

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?

- A low-severity issue on an offline lab VM - A medium-severity issue on a payroll server with no known exploit - A critical issue on an internet-facing web server with an available exploit - A high-severity issue on a test workstation that is not domain joined

Trap 1: The low-severity issue on the offline lab VM.

It has the lowest business exposure and the least immediate likelihood of exploitation.

Trap 2: The medium-severity issue on the payroll server with no known…

The asset is important, but the absence of an exploit lowers urgency compared with exposed critical flaws.

Trap 3: The high-severity issue on the test workstation that is not domain…

It is less exposed and less business-critical than the internet-facing production server.

A
The low-severity issue on the offline lab VM.
Why wrong: It has the lowest business exposure and the least immediate likelihood of exploitation.
B
The medium-severity issue on the payroll server with no known exploit.
Why wrong: The asset is important, but the absence of an exploit lowers urgency compared with exposed critical flaws.
C
The critical issue on the internet-facing web server with an available exploit.
This combines high severity, public exposure, and active exploitability, making it the highest-priority risk.
D
The high-severity issue on the test workstation that is not domain joined.
Why wrong: It is less exposed and less business-critical than the internet-facing production server.

Question 6mediummultiple choice

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Trap 1: Treat the alert as a confirmed breach and begin password resets for…

The source and request pattern indicate authorized testing, not evidence of an actual breach.

Trap 2: Block the scanner IP permanently to prevent future alerts from the…

Blocking an approved scanner can break vulnerability management and does not solve the validation problem.

Trap 3: Quarantine the reporting server because IDS alerts always indicate…

IDS alerts require context; many are benign tests, misconfigurations, or known maintenance activities.

A
Treat the alert as a confirmed breach and begin password resets for all portal users.
Why wrong: The source and request pattern indicate authorized testing, not evidence of an actual breach.
B
Mark the alert as a likely false positive after verifying the scanner schedule and source IP.
Authorized scanners often resemble attacks, so confirming the source and schedule is the right validation step.
C
Block the scanner IP permanently to prevent future alerts from the same host.
Why wrong: Blocking an approved scanner can break vulnerability management and does not solve the validation problem.
D
Quarantine the reporting server because IDS alerts always indicate active exploitation.
Why wrong: IDS alerts require context; many are benign tests, misconfigurations, or known maintenance activities.

Read the full VPN explanation →

Question 7mediummultiple choice

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

Trap 1: System 1, because the vulnerability is rated critical

Severity matters, but it is only one part of risk. A critical flaw with limited access may be less urgent than a lower-severity flaw on a heavily targeted public service.

Trap 2: Neither system, because both are internet-facing and must wait for…

Waiting for convenience alone ignores the current risk picture. When a system is actively under attack, postponing remediation can leave the business exposed to avoidable harm.

Trap 3: System 1, because VPN access always makes a vulnerability more…

VPN-restricted access can reduce exposure, but it does not automatically outweigh business impact and active attack conditions on another service. Risk must be assessed in context rather than by a single access condition.

A
System 1, because the vulnerability is rated critical
Why wrong: Severity matters, but it is only one part of risk. A critical flaw with limited access may be less urgent than a lower-severity flaw on a heavily targeted public service.
B
System 2, because it is exposed to the public and directly supports a business-critical service
System 2 should be patched first because risk depends on both exposure and business impact. A medium issue on a public payment site with active attacks presents a higher real-world risk than a critical issue on a system with narrower access. The payment service is also directly tied to revenue and customer trust, so delaying its remediation would create greater business exposure.
C
Neither system, because both are internet-facing and must wait for the next maintenance cycle
Why wrong: Waiting for convenience alone ignores the current risk picture. When a system is actively under attack, postponing remediation can leave the business exposed to avoidable harm.
D
System 1, because VPN access always makes a vulnerability more dangerous than a public application issue
Why wrong: VPN-restricted access can reduce exposure, but it does not automatically outweigh business impact and active attack conditions on another service. Risk must be assessed in context rather than by a single access condition.

Question 8mediummultiple choice

A finance application has a known vulnerability in a third-party reporting component. The vendor says a patch will not be available for six months, but the business cannot stop using the application. What is the BEST risk treatment for the organization to pursue next?

Trap 1: Avoid the risk by shutting down the finance application immediately.

Avoiding the risk would remove exposure, but it would also stop a critical business service that cannot be taken offline for six months.

Trap 2: Transfer the risk by asking the vendor to guarantee that no…

A guarantee is not a realistic risk treatment, and responsibility cannot simply be shifted away without contractual or technical controls.

Trap 3: Accept the risk because any delay in patching is automatically low…

Risk acceptance is only appropriate when the residual risk is within tolerance and formally approved. This situation still has meaningful exposure.

A
Avoid the risk by shutting down the finance application immediately.
Why wrong: Avoiding the risk would remove exposure, but it would also stop a critical business service that cannot be taken offline for six months.
B
Mitigate the risk by adding compensating controls and tracking residual risk until the patch is available.
This approach reduces the likelihood or impact of exploitation while keeping the business service running. Compensating controls such as increased monitoring, segmentation, additional access restrictions, and temporary workarounds are appropriate when a patch is unavailable. The organization can then document the remaining risk, assign an owner, and revisit the issue when the vendor releases the fix.
C
Transfer the risk by asking the vendor to guarantee that no incident will occur.
Why wrong: A guarantee is not a realistic risk treatment, and responsibility cannot simply be shifted away without contractual or technical controls.
D
Accept the risk because any delay in patching is automatically low priority.
Why wrong: Risk acceptance is only appropriate when the residual risk is within tolerance and formally approved. This situation still has meaningful exposure.