Vulnerability management

Question 1

__ is a continuous process of identifying, evaluating, treating, and
reporting security weaknesses in systems and networks to reduce risk

Answer 1

VUlnerability management

Question 2

stages of vulnerability management

Answer 2

Scan»_space; Patch»_space; Pentest»_space; report

Question 3

The automated process of identifying vulnerabilities in systems using specialized tools.

Answer 3

Scanning

Question 4

Detects outdated software, open port, weak configurations

Answer 4

Scanning

Question 5

Can be shceduled: daily, weekly, or monthly

Answer 5

scanning

Question 6

Produces detailed reports listing discovered vulnerabilities

Answer 6

scanning

Question 7

EXAMPLES OF SCANNING

detects missing security patches & updates

Answer 7

Nessus

Question 8

EXAMPLES OF SCANNING

scans networks for known risks

Answer 8

OpenVAS

Question 9

EXAMPLES OF SCANNING

identifies open ports and running services

Answer 9

Nmap

Question 10

The process of updating systems or software to fix known vulnerabilities discovered during scanning.

Answer 10

Patching

Question 11

EXAMPLES OF PATCHING

windows/linux security patches

Answer 11

OS updates

Question 12

EXAMPLES OF PATCHING

fixing web server CVEs

Answer 12

Apache HTTP Server

Question 13

EXAMPLES OF PATCHING

applying security updates to apps

Answer 13

Mobile apps

Question 14

fixes security holes discovered during scanning

Answer 14

patching

Question 15

requires testing before deployment in live environments

Answer 15

patching

Question 16

must be done regularly to maintain a secure posture

Answer 16

Patching

Question 17

The controlled simulation of cyberattacks to determine if vulnerabilities can be exploited — conducted
ethically with permission.

Answer 17

basic penetration testing

Question 18

goes beyond scanning, actively exploits weaknesses

Answer 18

pentest

Question 19

always conducted ethically and with written permission

Answer 19

pentest

Question 20

helps understand real-world impact of vulnerabilities

Answer 20

pentest

Question 21

EXAMPLES OF PENTEST

exploit known vulnerabilities in targets

Answer 21

metasploit

Question 22

EXAMPLES OF PENTEST

attempt unauthorized system access

Answer 22

Login bypass

Question 23

EXAMPLES OF PENTEST

test misconfigured services and auth

Answer 23

Weak passwords

Question 24

Documenting vulnerabilities, their severity, and recommended fixes to communicate findings to
management or IT teams.

Answer 24

Reporting

Question 25

communicates findings to management and IT teams

Answer 25

Reporting

Question 26

includes risk levels: low, medium, high, and critical

Answer 26

Reporting

Question 27

suggests concrete mitigation strategies for each finding

Answer 27

Reporting

Question 28

SECURITY LEVEL outdated server with public exploit

Answer 28

Critical

Question 29

SECURITY LEVEL unpatched RCE in web application

Answer 29

High

Question 30

SECURITY LEVELS Weak password policy enforced

Answer 30

Medium

Question 31

SECURITY LEVELS verbose error messages exposed

Answer 31

Low

Question 32

CONCEPT FLOW - VM CYCLE

Answer 32

Scan >> analyze >> patch >> pentext >> report

Question 33

This is a CONTINUOUS cycle — after reporting, the process starts again with a new scan.

Answer 33

Vulnerability management