Skip to content

Module 05 — Vulnerability Analysis · Practice Questions

Original, concept-based questions — not exam dumps. Answers are collapsed: decide first, then expand. Target ≥80%. Pairs with facts.md · flashcards.csv · README.md.

Q1. How does a vulnerability assessment differ from a penetration test?

  • A. They are identical
  • B. A VA always includes exploitation
  • C. A VA identifies and ranks weaknesses (breadth); a pentest exploits them to prove impact (depth)
  • D. A pentest never uses tools
Answer **C.** VA is broad identification + prioritization; a pentest goes deep by actually exploiting selected findings to demonstrate real-world impact. CEH tests this distinction directly.

Q2. A CVSS base score of 9.1 falls in which severity band (v3)?

  • A. Low
  • B. Medium
  • C. High
  • D. Critical
Answer **D. Critical (9.0–10.0).** Bands: 0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical.

Q3. What's the difference between a CVE and a CWE?

  • A. CVE is a weakness type; CWE is a specific vulnerability
  • B. CVE is a specific known vulnerability instance; CWE is the general weakness class
  • C. They are the same registry
  • D. CWE only applies to hardware
Answer **B.** A **CVE** identifies one specific vulnerability (e.g., CVE-2017-0144); a **CWE** names the underlying weakness type (e.g., CWE-89 SQL Injection). A CVE is usually mapped to one or more CWEs.

Q4. Why do authenticated (credentialed) scans produce better results?

  • A. They run faster
  • B. They only scan open ports
  • C. They don't need a scanner
  • D. They log into hosts, revealing missing patches and config issues invisible from outside, with fewer false positives
Answer **D.** With credentials the scanner reads installed patch levels and configs directly, so it finds more real issues and produces fewer false positives than an unauthenticated external view.

Q5. A scanner flags a vulnerability that, on inspection, does not actually exist. This is a:

  • A. False positive
  • B. False negative
  • C. True positive
  • D. Zero-day
Answer **A. False positive.** (A **false negative** — missing a real vulnerability — is generally more dangerous because it creates false confidence.)

Q6. Put the vulnerability-management lifecycle in order:

  • A. Remediation → Assessment → Monitoring → Verification
  • B. Assessment → Risk assessment → Remediation → Verification → Monitoring
  • C. Verification → Remediation → Assessment
  • D. Monitoring → Remediation → Assessment
Answer **B.** Baseline/assess → rank the risk → remediate (patch/harden) → verify by re-scanning → continuously monitor. Verification (the re-scan) is what confirms the fix actually worked.

Q7. Which tool is an open-source vulnerability scanner?

  • A. Nessus
  • B. Burp Suite Pro
  • C. OpenVAS / Greenbone (GVM)
  • D. Cobalt Strike
Answer **C. OpenVAS/GVM.** Nessus is commercial; Burp is a web proxy; Cobalt Strike is a C2 framework. Nikto is another open-source (web-focused) scanner.

Q8. Why prioritize remediation by risk rather than raw CVSS base score alone?

  • A. CVSS is always wrong
  • B. Context — asset value, exposure, and exploit availability — changes the real risk
  • C. Risk scoring is illegal
  • D. CVSS doesn't exist
Answer **B.** A "High" CVSS on an isolated, non-critical host may matter less than a "Medium" on an internet-facing crown-jewel. Temporal/environmental metrics and exploit likelihood (e.g., EPSS) refine the base score into real risk.

Q9. A configuration/compliance scan primarily checks:

  • A. Only for CVEs
  • B. Network bandwidth
  • C. Systems against a hardening benchmark (e.g., CIS)
  • D. Password strength only
Answer **C.** Compliance scans compare a system's settings to a benchmark (CIS, DISA STIG) — catching misconfigurations that aren't tracked as CVEs.

Q10. The NVD provides:

  • A. Enriched CVE data (CVSS scores, CPE, references)
  • B. Exploit code for every CVE
  • C. A firewall
  • D. A password cracker
Answer **A.** The National Vulnerability Database enriches CVEs with CVSS scoring, CPE product identifiers, and references — the authoritative lookup for a CVE's details.

Q11. From a PAM perspective, a common overlooked risk in vulnerability scanning is:

  • A. The scanner is too colorful
  • B. CVSS scores expire
  • C. Scans are always passive
  • D. The scanner's credentialed account is standing and over-privileged — a prime theft target
Answer **D.** Credentialed scanners often carry powerful standing accounts. Vault them, rotate them, and grant **JIT** so a leaked scanner config doesn't hand over durable privilege. Also patch the PAM stack itself (it's Tier 0).

Q12. Active vs passive vulnerability scanning:

  • A. Active sends probes to the target; passive observes traffic/metadata without probing
  • B. Active observes traffic; passive sends probes
  • C. They are identical
  • D. Passive requires exploitation
Answer **A.** Active scanning interacts with the target (and may disrupt fragile systems — relevant for OT); passive scanning infers vulnerabilities from observed traffic without touching the target.

Score yourself

  • 10–12: strong — memorize the CVSS bands and CVE-vs-CWE distinction in facts.md.
  • 7–9: re-read the lifecycle and authenticated-scan sections.
  • < 7: redo the lab-walkthrough.md with OpenVAS/Nikto against Metasploitable2.