CompTIA CySA+ Vulnerability Management Practice Questions

Question 1

What does CVSS stand for? (Q-924433)

Accepted Answer

Common Vulnerability Scoring System

Answer

Critical Vulnerability Severity Score

Answer

Common Vulnerability Security Standard

Answer

Critical Vulnerability Security System

Question 2

Which of the following is a characteristic of a zero-day vulnerability? (Q-924440)

Accepted Answer

It is unknown to the vendor and has no available patch

Answer

It has been patched by the vendor

Answer

It is only exploitable in physical access attacks

Answer

It affects only legacy systems

Question 3

What is the PRIMARY purpose of a vulnerability scan? (Q-627ffe)

Accepted Answer

To identify potential security weaknesses

Answer

To exploit discovered vulnerabilities

Answer

To restore systems after an attack

Answer

To train employees on security policies

Question 4

During a vulnerability scan, you identify multiple systems with missing KB patches. What is the BEST approach to prioritize remediation?

Accepted Answer

Prioritize based on CVSS scores and asset criticality

Answer

Patch all systems alphabetically

Answer

Focus on systems with internet exposure first

Answer

Wait until the next maintenance window

Question 5

What type of vulnerability scan authenticates to the target system to provide a more detailed assessment?

Accepted Answer

Credentialed scan

Answer

Non-credentialed scan

Answer

Passive scan

Answer

Discovery scan

Question 6

Which factor should raise the priority of a vulnerability finding?

Accepted Answer

Known exploitation on an Internet-facing critical asset

Answer

Long vendor name

Answer

Low screen brightness

Answer

Use of a wired mouse

Question 7

Which remediation step verifies that a patch actually reduced exposure?

Accepted Answer

Rescan the asset after patching

Answer

Delete the scanner report

Answer

Disable asset inventory

Answer

Change the ticket title only

Question 8

A vulnerability has a high CVSS score but exists only on a decommissioned host. What should influence prioritization?

Accepted Answer

Asset status and business exposure

Answer

Alphabetical plugin name

Answer

Screen resolution

Answer

Keyboard type

Question 9

Which vulnerability scan result most likely needs manual validation before reporting as exploitable?

Accepted Answer

Unauthenticated banner-based finding

Answer

Confirmed exploit output

Answer

Verified missing patch with credentials

Answer

Vendor advisory with exact version match

Question 10

What should be included in a remediation ticket for a vulnerable server?

Accepted Answer

Affected asset, vulnerability, risk, owner, due date, and validation method

Answer

Only the scanner logo

Answer

Only the analyst name

Answer

A screenshot with no context

Question 11

Which vulnerability management metric tracks how long findings remain unresolved?

Accepted Answer

Mean time to remediate

Answer

Packet TTL

Answer

Signal-to-noise ratio only

Answer

Screen refresh rate

CompTIA CySA+ Practice Questions: Vulnerability Management

Q1. What does CVSS stand for? (Q-924433)

Q2. Which of the following is a characteristic of a zero-day vulnerability? (Q-924440)

Q3. What is the PRIMARY purpose of a vulnerability scan? (Q-627ffe)

Q4. During a vulnerability scan, you identify multiple systems with missing KB patches. What is the BEST approach to prioritize remediation?

Q5. What type of vulnerability scan authenticates to the target system to provide a more detailed assessment?

Q6. Which factor should raise the priority of a vulnerability finding?

Q7. Which remediation step verifies that a patch actually reduced exposure?

Q8. A vulnerability has a high CVSS score but exists only on a decommissioned host. What should influence prioritization?

Q9. Which vulnerability scan result most likely needs manual validation before reporting as exploitable?

Q10. What should be included in a remediation ticket for a vulnerable server?

Q11. Which vulnerability management metric tracks how long findings remain unresolved?

More CompTIA CySA+ practice topics