Chapter 5 Analyzing Vulnerability Scans

Tom is reviewing a vulnerability scan report and finds that one of the servers on his network suffers from an internal IP address disclosure vulnerability. What protocol is likely in use on this network that resulted in this vulnerability?

• A. TLS

• B. NAT

• C. SSH

• D. VPN

Which one of the CVSS metrics would contain information about the number of times an attacker must successfully authenticate to execute an attack?

• A. AV

• B. C

• C. Au

• D. AC

Which one of the following values for the CVSS access complexity metric would indicate that the specified attack is simplest to exploit?

• A. High

• B. Medium

• C. Low

• D. Severe

Which one of the following values for the confidentiality, integrity, or availability CVSS metric would indicate the potential for total compromise of a system?

• A. N

• B. A

• C. P

• D. C

What is the most recent version of CVSS that is currently available?

• A. 1.0

• B. 2.0

• C. 2.5

• D. 3.0

Which one of the following metrics is not included in the calculation of the CVSS exploit ability score?

• A. Access vector

• B. Vulnerability age

• C. Access complexity

• D. Authentication

Kevin recently identified a new security vulnerability and computed its CVSSv2 base score as 6.5. Which risk category would this vulnerability fall into?

• A. Low

• B. Medium

• C. High

• D. Critical

Tara recently analyzed the results of a vulnerability scan report and found that a vulnerability reported by the scanner did not exist because the system was actually patched as specified. What type of error occurred?

• A. False positive

• B. False negative

• C. True positive

• D. True negative

Which one of the following is not a common source of information that may be correlated with vulnerability scan results?

• A. Logs

• B. Database tables

• C. SIEM

• D. Configuration management system

Which one of the following operating systems should be avoided on production networks?

• A. Windows Server 2003

• B. Red Hat Enterprise Linux 7

• C. CentOS 7

• D. Ubuntu 16