CySA+ Vulnerability Management: 132 practice questions

12 of the 132 Vulnerability Management questions in the Certsqill CySA+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CySA+? Take the free 5-min readiness check →

1. CVE-A, because it is remotely exploitable with no: Which vulnerability should be patched FIRST?

1. CVE-A, because it is remotely exploitable with no authentication and has the highest CVSS score ✓

   Correct. CVE-A has the highest CVSS base score (9.8/Critical), is network-exploitable with no privileges or user interaction required, and fully compromises confidentiality, integrity, and availability. Combined with direct Internet exposure and no WAF, this presents the greatest immediate risk.
2. CVE-B, because it requires user interaction, making exploitation more realistic in a social engineering context

   Incorrect. While CVE-B requires user interaction (raising exploitability concerns via phishing), its CVSS score of 7.5 is significantly lower than CVE-A's 9.8. CVE-A requires zero prerequisites for exploitation against an Internet-facing server.
3. CVE-C, because network-adjacent vulnerabilities are frequently exploited in internal pivoting scenarios

   Incorrect. CVE-C requires an attacker to already be on an adjacent network segment, a constraint that significantly limits its exploitability compared to a remotely exploitable, unauthenticated critical vulnerability. CVE-A poses a more immediate risk.
4. CVE-D, because local access vulnerabilities on Internet-facing servers indicate a host has already been compromised

   Incorrect. CVE-D requires local access and has the lowest CVSS score. If local access were confirmed, it would be an incident response scenario, not a prioritization question. The unauthenticated, remotely exploitable CVE-A must be addressed first.

CVE-A's Critical CVSS score, zero prerequisites for exploitation, and direct Internet exposure make it the highest-priority remediation target.

2. Credentialed scans authenticate to the target and inspect: Which explanation BEST accounts for this difference

1. Credentialed scans authenticate to the target and inspect installed software versions, registry settings, and patch levels that are not visible externally ✓

   Correct. Credentialed scans log in to the target OS with administrative credentials and perform local checks (installed package versions, registry keys, configuration files). This reveals vulnerabilities in software that has no network-facing service — a non-credentialed scan can only see what is exposed over the network.
2. Non-credentialed scans use a slower scanning engine that misses vulnerabilities due to timeout errors

   Incorrect. The performance difference between scan types is not the cause of the detection gap. The fundamental difference is that non-credentialed scans are limited to network-observable information, regardless of scan speed.
3. Credentialed scans benefit from updated vulnerability signatures that are only released quarterly

   Incorrect. Vulnerability signature databases (NASL plugins, etc.) are typically updated continuously and applied to both scan types. The detection gap is structural, not a result of signature update frequency.
4. Non-credentialed scans intentionally suppress low-severity findings to reduce alert noise

   Incorrect. Non-credentialed scans do not selectively suppress findings by severity. The difference is in access — without credentials, the scanner cannot assess local software state regardless of the desired output.

Credentialed scans authenticate to the target and inspect local software state, revealing vulnerabilities invisible to network-only non-credentialed scans.

3. System D, because active exploitation in the wild combined: A vulnerability management analyst must prioritize

1. System D, because active exploitation in the wild combined with Internet exposure represents the highest immediate real-world risk ✓

   Correct. Risk-based prioritization multiplies likelihood × impact. System D has an active exploit (dramatically increases likelihood of exploitation), is Internet-facing (maximizes attacker reach), and a 6.8 CVSS score still represents medium-high severity. CVSS alone would rank System C highest, but System C is air-gapped (greatly reducing likelihood) and has no available patch. System D's active exploitation status overrides the higher CVSS scores of other systems.
2. System C, because it has the highest CVSS score of 9.8

   Incorrect. While System C has the highest base CVSS score, it is air-gapped, meaning direct network exploitation is not possible. Additionally, there is no patch available, so 'patching first' is not an option for System C. Risk-based prioritization requires factoring in exploitability context, not just CVSS score.
3. System A, because it is Internet-facing and processes payment data (PCI DSS scope)

   Incorrect. System A is high-value (PCI DSS scope) and Internet-facing, but its CVSS of 7.2 and no active exploitation make it lower immediate priority than System D, which faces active exploitation. System A should be patched urgently, but not before System D.
4. System B, because a CVSS 9.1 vulnerability should be addressed immediately regardless of asset criticality

   Incorrect. This answer demonstrates the 'pure CVSS' trap — System B is an internal HR portal with no sensitive data and the patch is still in testing. Its internal-only exposure means the attack surface is limited to already-authenticated internal users. Risk context matters.

System D's active exploitation in the wild on an Internet-facing system represents the highest immediate risk, overriding higher CVSS scores from systems with reduced exposure.

4. Implement runtime container security policies to restrict: Which is the BEST immediate compensating control?

1. Implement runtime container security policies (e.g., Falco rules or seccomp profiles) to restrict the capabilities available to the vulnerable container ✓

   Correct. Runtime security controls restrict what a vulnerable container can do even if the underlying CVE is exploited. Falco can detect and block anomalous system calls; seccomp profiles restrict the Linux kernel syscalls available to the container process. This is a direct compensating control that reduces exploitability while the patch is being prepared.
2. Delete the vulnerable container image from the registry and redeploy from a previous version

   Incorrect. Reverting to a previous version likely contains the same or older vulnerabilities, as the CVE is in the base OS layer (not a recently introduced regression). Rolling back does not resolve the vulnerability.
3. Accept the risk in writing and schedule the base image update for the next quarterly patching cycle

   Incorrect. A Critical CVE in a production container warrants immediate action. Scheduling remediation for a quarterly cycle without any compensating control is not an acceptable risk management response for a Critical-severity finding.
4. Move the affected container to a separate Kubernetes namespace to isolate it from other workloads

   Incorrect. Kubernetes namespace isolation is a logical separation mechanism; by default, it does not block network traffic between namespaces without explicit NetworkPolicy. Namespace isolation is not a sufficient compensating control for an exploitable OS-layer CVE.

Runtime security policies (Falco, seccomp) restrict what a vulnerable container can do, serving as a compensating control while the base image patch is prepared.

5. SQL Injection: Which vulnerability does this MOST likely indicate?

1. SQL Injection ✓

   Correct. The test input '1' OR '1'='1' is a classic SQL injection probe. The condition '1'='1' is always true, causing the database query to return all rows instead of the expected single record. The fact that the application returned the full catalog confirms that the SQL query was modified by the injected input.
2. Cross-Site Scripting (XSS)

   Incorrect. XSS involves injecting client-side scripts (JavaScript) into the application response that execute in other users' browsers. The test payload contains SQL syntax ('OR '1'='1'), not script tags or JavaScript. The behavior (returning extra data) is consistent with SQL injection, not XSS.
3. Command Injection

   Incorrect. Command injection involves injecting OS-level commands (e.g., ; ls, | whoami) into parameters that are passed to system calls. The test payload uses SQL syntax and produces database output changes, which is characteristic of SQL injection.
4. Insecure Direct Object Reference (IDOR)

   Incorrect. IDOR occurs when an application exposes direct references to internal objects (like database IDs) without proper authorization checks, allowing an attacker to access other users' data by modifying the ID. The vulnerability here is SQL injection — the application's database query is being manipulated by injected SQL syntax.

The ' OR '1'='1 payload is a SQL injection test that manipulates the WHERE clause to return all rows — confirmed by the full catalog response.

6. 28% of the benchmark's security configuration: Which statement BEST describes what this result indicates?

1. 28% of the benchmark's security configuration recommendations are not implemented on this server ✓

   Correct. CIS Benchmarks define configuration hardening recommendations. A 72% compliance score means 72% of the benchmark controls are correctly configured, and 28% are not. Each failed check represents a potential configuration weakness that could be exploited or represents a compliance gap.
2. The server has 28 vulnerabilities with a CVSS score above 7.0

   Incorrect. CIS Benchmark compliance scores measure configuration hardening against security best practices, not CVE/CVSS vulnerability scoring. Compliance scans and vulnerability scans produce different outputs and should not be conflated.
3. The server will be breached 28% of the time based on historical attack data

   Incorrect. Compliance percentages are not breach probability predictions. A 72% compliance score indicates configuration gaps; it does not directly translate to breach likelihood, which depends on many additional factors (exposure, threat landscape, compensating controls).
4. The server meets the minimum security requirements for Level 2 CIS benchmarks

   Incorrect. CIS Level 1 (basic hardening) and Level 2 (defense-in-depth for higher-security environments) are separate benchmark tiers. A 72% score on Level 1 means the server fails Level 1 compliance — it does not indicate any Level 2 status.

A 72% CIS Benchmark compliance score means 28% of the benchmark's security configuration recommendations are not correctly implemented on that server.

7. System 3 → System 1 → System 4 → System 2: An organization's vulnerability management program identifies the s

1. System 3 → System 1 → System 4 → System 2 ✓

   Correct. System 3 (Internet-facing, PCI DSS scope, direct revenue impact) has the highest combined risk: external exposure + financial/regulatory consequences. System 1 (Domain Controller, critical authentication infrastructure, 5,000 user impact) is next — compromise enables full domain takeover. System 4 (internal, low-sensitivity data) is lower priority. System 2 (isolated dev network, no production access) is lowest — the isolation significantly limits attacker impact.
2. System 1 → System 3 → System 2 → System 4

   Incorrect. While the Domain Controller is critical infrastructure, the public-facing e-commerce server is directly Internet-exposed with PCI DSS compliance implications — immediate external exploitability makes it the highest-priority target. A compromised public server can directly impact customers and trigger regulatory penalties.
3. All four systems should be patched simultaneously since the CVSS score is identical

   Incorrect. While simultaneous patching is ideal, resources are rarely unlimited. Risk-based prioritization using asset criticality and exposure context allows efficient resource allocation. Treating all CVSS 8.1 findings equally ignores context that materially affects real-world risk.
4. System 2 → System 4 → System 1 → System 3

   Incorrect. This reverses the correct priority order. Isolated development workstations should be patched last, not first, when the same vulnerability exists on Internet-facing and critical infrastructure systems.

Risk-based prioritization: Internet-facing PCI system (external exposure + regulatory risk) > Domain Controller (critical auth infrastructure) > internal file share > isolated dev workstation.

8. Deploy separate scan engines in each segment: What scanning architecture BEST achieves this?

1. Deploy separate scan engines in each segment: one in the DMZ, one in the corporate network, and one in the OT/ICS segment — coordinated from a central vulnerability management console ✓

   Correct. Deploying distributed scan engines within each network segment ensures accurate credentialed scan results unaffected by firewall rules between segments. The OT/ICS scanner must be isolated to that segment (air-gap requirement). A central console provides unified reporting while respecting network architecture.
2. Deploy a single scanner on the corporate network and configure firewall rules to allow scanning traffic to the DMZ and OT/ICS segments

   Incorrect. Opening firewall rules to allow scan traffic to OT/ICS segments violates the air-gap requirement and introduces unacceptable risk to operational technology environments. A single scanner across segments also degrades scan accuracy due to firewall filtering and network latency.
3. Use an Internet-based cloud scanning service for all three segments to eliminate the need for on-premises scanner deployment

   Incorrect. Cloud-based scanners cannot reach the internal corporate network or OT/ICS segments (which are not Internet-accessible by design). Cloud scanning is only applicable for DMZ/Internet-facing assets. Internal and OT segments require on-premises scan engines.
4. Scan only the DMZ, since it is the only segment exposed to external attackers

   Incorrect. Internal network and OT segment vulnerabilities can be exploited by insider threats, lateral movement from a compromised DMZ host, or physically accessible attack vectors. Vulnerability management must cover all segments, with risk-appropriate scanning approaches for each.

Distributed scan engines in each network segment ensure accurate results while respecting air-gap requirements for OT/ICS networks and firewall boundaries.

9. Implement compensating controls: Which is the MOST appropriate action?

1. Implement compensating controls (network segmentation, WAF/firewall rules, enhanced monitoring), document a formal risk acceptance with business owner approval, and schedule the patch for deployment when available ✓

   Correct. When patching is not immediately possible, the risk management response is: (1) implement compensating controls to reduce exploitability, (2) document risk acceptance formally with business owner sign-off (creates accountability and audit trail), (3) schedule the patch for when it becomes available. This follows NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and CA-7 risk acceptance procedures.
2. Accept the risk verbally with the application owner and wait for the vendor patch to be released

   Incorrect. Verbal risk acceptance is not documentable and creates no accountability or audit trail. Critical vulnerabilities require formal written risk acceptance with documented compensating controls, approval by an appropriate authority level, and a defined review/remediation date.
3. Immediately decommission the legacy application to eliminate the vulnerability risk

   Incorrect. The scenario states the application cannot be taken offline — decommissioning violates this constraint. Even if decommissioning were possible, it represents an extreme action that should follow a proper business decision process, not be decided unilaterally by a security team.
4. Escalate the issue to the vendor and demand the patch be expedited within 30 days

   Incorrect. While engaging the vendor is appropriate, demanding a patch timeline the vendor has already stated is impossible does not protect the organization. The organization must manage its own risk through compensating controls and formal risk acceptance during the 90-day patch window.

When patching is impossible, deploy compensating controls, formally document risk acceptance with business owner approval, and track to patch availability.

10. The vulnerability is classified as an Improper: Which statement BEST describes what CWE-89 indicates about thi

1. The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) weakness ✓

   Correct. CWE (Common Weakness Enumeration) classifies the type of software weakness. CWE-89 is 'Improper Neutralization of Special Elements used in an SQL Command' — the standard classification for SQL injection vulnerabilities. A CVE entry with CWE-89 tells the analyst the root cause is SQL injection.
2. The vulnerability affects 89 systems in the organization's environment

   Incorrect. CWE numbers are fixed identifiers for software weakness categories, not quantities of affected systems. The number of affected systems in an organization is determined by the vulnerability scanner, not by the CVE/CWE entry.
3. The vulnerability has been assigned a CVSS environmental score of 89 by the NVD

   Incorrect. CWE and CVSS are separate classification systems. CVSS scores range from 0-10, not 0-100. CWE-89 is a weakness classification identifier, not a CVSS score modifier.
4. The CVE is the 89th vulnerability reported in 2024 and affects all web application frameworks

   Incorrect. CVE year-sequence numbering and CWE classification are independent systems. CWE-89 does not mean '89th vulnerability in a year' — it is a persistent identifier for the SQL injection weakness type in the CWE taxonomy.

CWE-89 is the Common Weakness Enumeration identifier for SQL Injection — it classifies the root-cause weakness type of the vulnerability.

11. False positive: Which term BEST describes this scan result, and what is the recommended corrective action?

1. False positive — the vulnerability does not exist in the installed version; the corrective action is to investigate the banner version discrepancy and update the scan plugin or configure the scanner to perform binary-version checking ✓

   Correct. A false positive is when a scanner reports a vulnerability that does not actually exist on the target. The scanner reads the HTTP Server version banner (which may display a different version than installed) and incorrectly flags a patched system. Corrective actions: (1) investigate why the banner doesn't reflect actual version, (2) use credentialed scanning with binary-level version checks, (3) report the false positive to the scanner vendor for plugin correction.
2. False negative — the scanner missed the actual vulnerability because it only checks version banners

   Incorrect. A false negative is when a real vulnerability exists but is not detected. Here the scanner IS detecting and reporting the vulnerability — incorrectly, because the software is actually patched. This is a false positive (reported vulnerability that doesn't exist), not a false negative.
3. True positive — the version banner confirms the vulnerable version is installed, and the patch team's investigation is incorrect

   Incorrect. The patch team physically verified the installed binary is version 2.4.56 (patched). The version banner discrepancy is the source of the false positive. The scanner result is incorrect; the patch team's verification is correct.
4. True negative — the system is patched and the scanner correctly reports no vulnerability

   Incorrect. A true negative is when no vulnerability exists and the scanner correctly reports no finding. Here the scanner is incorrectly reporting a vulnerability on a patched system — a false positive, not a true negative.

A scanner reporting a vulnerability that doesn't exist (patched binary, outdated banner) is a false positive. Fix: credentialed binary-level version checking or banner configuration.

12. CVE-C — CISA KEV status confirms active exploitation: A vulnerability analyst reviews the following findings f

1. CVE-C — CISA KEV status confirms active exploitation in the wild, making it the definitive highest-priority finding regardless of raw CVSS or EPSS scores ✓

   Correct. CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with confirmed active exploitation by threat actors in real-world attacks. KEV listing is the strongest real-world exploitability signal available. CVE-C has confirmed active exploitation (KEV) + high EPSS (42.1%) + high CVSS (8.0) — all three indicators align. CVE-B has high EPSS but no confirmed exploitation (KEV); CVE-A has Critical CVSS but 0.3% exploitation probability.
2. CVE-A — CVSS 9.8 Critical indicates the most severe potential impact and should always be patched first

   Incorrect. EPSS of 0.003 means only 0.3% of similar vulnerabilities are exploited within 30 days — CVE-A has critical theoretical severity but extremely low observed exploitation probability. Without active exploitation evidence, the risk is primarily theoretical. CVE-C's active exploitation (KEV) makes it definitively more urgent.
3. CVE-B — the highest EPSS score (0.892) indicates the highest probability of near-term exploitation

   Incorrect. CVE-B has the highest EPSS probability, indicating high likelihood of exploitation. However, CVE-C has confirmed active exploitation (KEV) — it is ALREADY being exploited, not just predicted to be. Confirmed exploitation is higher priority than predicted exploitation.
4. CVE-D — moderate CVSS with low EPSS represents the best balance of severity and manageability for immediate patching

   Incorrect. CVE-D has both a lower CVSS (7.2) and the second-lowest EPSS (1.5%). There is no risk-based rationale for prioritizing this vulnerability over the others, all of which have higher severity or exploitation probability.

CISA KEV status = confirmed active real-world exploitation, which overrides EPSS predictions and raw CVSS scores. CVE-C's KEV listing makes it the definitive first priority.

Other CySA+ domains

• Security Operations — 181 questions →
• Incident Response Management — 114 questions →
• Reporting and Communication — 72 questions →
• All 499 CySA+ questions →