4 Vulnerability Management Free Online FlashCards

What is vulnerability management?

It is the continuing process of finding security weaknesses, prioritizing them, reducing their risk, and checking that the response worked.

Why maintain an accurate asset inventory?

An accurate inventory helps ensure scans cover the organization’s hardware, software, cloud resources, and services. Unknown or untracked assets can be missed and left exposed.

How do credentialed and external vulnerability scans differ?

Credentialed scans can inspect more system details than unauthenticated scans; external scans show what an outside observer can reach.

What does software composition analysis identify?

Software composition analysis identifies vulnerable third-party libraries and packages, including dependencies that may not be visible in a network scan.

What should be checked before treating a scanner finding as confirmed?

Confirm that the affected product and version are present, check whether the vulnerable feature is enabled or reachable where relevant, and rule out a false positive.

What does CVSS describe, and what can it not determine alone?

CVSS describes a vulnerability’s technical severity, but it does not by itself determine the risk to a particular organization.

What does EPSS estimate?

EPSS estimates the probability that a publicly disclosed vulnerability will be exploited in the wild within 30 days. It is a likelihood signal, not a complete risk score.

What does a listing in CISA’s KEV Catalog indicate?

Listing in the KEV Catalog is evidence that a vulnerability is known to be exploited, making exploitation evidence relevant to prioritization.

Which asset-context factors influence vulnerability priority?

Consider whether the system is internet-facing, business-critical, sensitive, or a path to other systems, along with whether the vulnerable component is reachable and enabled.

How can an organization temporarily mitigate a vulnerability?

If a safe fix is unavailable or cannot yet be deployed, reduce exposure—for example, disable the affected feature, restrict access, or isolate the system. Track the mitigation and plan a permanent fix where feasible.

What should be documented when accepting vulnerability risk?

Document the rationale, residual risk, approval, safeguards, and review date. Risk acceptance is an authorized decision, not a fix for the flaw.

What are the main steps in enterprise patch management?

Enterprise patch management involves identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades.