CySA+ Vulnerability Remediation and Patch Strategy

1. Which metric in CVSS indicates the complexity of exploiting a vulnerability?

Attack Vector

Attack Complexity

Privileges Required

User Interaction

2. What is the main benefit of automated patch management?

Reduces manual effort and speeds deployment

Eliminates the need for testing

Prevents all vulnerabilities

Removes vendor responsibility

3. Which scanning tool is commonly used for network vulnerability assessment?

Nessus

Git

Jenkins

Docker

4. What is a vulnerability waiver used for?

To ignore all vulnerabilities

To formally document accepted risk for unpatched vulnerabilities

To prevent scanning

To delay patches indefinitely

5. Which approach prioritizes patching based on threat intelligence and active exploits?

Severity-based prioritization

Threat-based prioritization

Age-based prioritization

Vendor-based prioritization

6. What is the purpose of a vulnerability baseline?

To eliminate all vulnerabilities

To establish a reference point for tracking vulnerability changes

To prevent vulnerability scanning

To document vendor information

7. Which vulnerability severity level typically requires immediate remediation?

Low

Medium

Critical

Informational

8. What does patch Tuesday refer to?

The day vendors release patches

Microsoft's monthly patch release schedule

A testing day for patches

The deadline for patch deployment

9. Which organization publishes the National Vulnerability Database (NVD)?

CompTIA

NIST

ISC2

SANS

10. What is compensating control in vulnerability management?

A control that replaces a patch

An alternative control reducing risk when direct remediation isn't possible

A control that compensates vendors

A control that delays patching

11. Which vulnerability scoring system is most commonly used to prioritize patching efforts?

CVSS

DISA

NIST

ISO

12. What is the primary purpose of a vulnerability management policy?

To eliminate all vulnerabilities

To establish standards and procedures for handling vulnerabilities

To document vendor contact information

To prevent security audits

13. Which patch management strategy involves gradual deployment across systems?

Big-bang approach

Phased rollout

Emergency patching

Zero-trust patching

14. What does a false positive in vulnerability scanning indicate?

A real vulnerability was missed

A vulnerability reported that doesn't actually exist

A patched vulnerability was rescanned

A critical vulnerability was found

15. Which remediation approach involves accepting the risk without patching?

Mitigation

Acceptance

Avoidance

Transference

16. What is a zero-day vulnerability?

A vulnerability disclosed publicly for zero days

An unpatched vulnerability unknown to the vendor

A vulnerability with zero severity rating

A vulnerability patched within one day

17. Which vulnerability scanning method actively probes systems for weaknesses?

Passive scanning

Active scanning

Static analysis

Code review

18. What does CVSS Base Score range from?

0 to 5

0 to 10

1 to 100

1 to 10

19. Which phase involves testing patches in a controlled environment before production deployment?

Vulnerability scanning

Patch validation

Risk assessment

Compliance auditing

20. What is the primary goal of vulnerability management?

Eliminate all vulnerabilities immediately

Identify, assess, and remediate vulnerabilities systematically

Document every vulnerability found

Report vulnerabilities to vendors only

CySA+ Vulnerability Remediation and Patch Strategy Quiz