Free Practice Quiz Question List

4 Vulnerabilities and Risk Online Quiz Questions

Use this free practice quiz with 20 questions to review 4 Vulnerabilities and Risk, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: Finding a vulnerability in a system is, by itself, proof that an attacker has compromised the system.

A
True
B
False

Fill in the blank

1 point

A vulnerability is a in a system, its implementation, or its security procedures that a threat source could exploit or trigger.

Written response

1 point

What term describes how reachable or accessible a vulnerable asset is to potential attackers?

Written response

1 point

What term describes how feasible it is for an attacker to use a vulnerability?

Choose one

1 point

A team sees a high CVSS score for a vulnerability. Which conclusion is best supported?

A
A high CVSS score proves the vulnerability is already being exploited.
B
A CVSS score helps express technical severity, but more context is needed to assess organizational risk.
C
A CVSS score measures only how many systems are affected.
D
A high CVSS score means the vulnerability cannot be mitigated with temporary controls.

Choose one

1 point

A patch is not yet available, so a team restricts access to a vulnerable service while planning to change the system later. Which statement best describes these actions?

A
Remediation always means isolating the asset; mitigation always means installing a patch.
B
Remediation and mitigation both mean removing the underlying vulnerability permanently.
C
Remediation may patch or change the affected system; mitigation may temporarily limit access or isolate it.
D
Mitigation is used only after remediation has been verified.

Choose one

1 point

A vulnerable service must remain installed until a patch can be applied. Which action most directly reduces its exposure without removing the vulnerability?

A
Leave the service accessible to everyone and wait for a patch.
B
Restrict network access to the vulnerable service.
C
Increase the CVSS score assigned to the vulnerability.
D
Assume the system is no longer vulnerable once a scanner has reported the finding.

True or false

1 point

True or false: A vulnerability scanner can produce false positives or miss issues, so its findings should be reviewed in context.

A
True
B
False

Fill in the blank

1 point

After reviewing scanner results against reliable vulnerability information, assessment teams should important findings.

Choose all

1 point

Which characteristics are considered by CVSS Base metrics? Select all correct answers.

A
How an attacker can reach the flaw
B
What privileges are required
C
Whether user interaction is required
D
Possible effects on confidentiality, integrity, and availability
E
The affected organization's business importance for that system
F
Whether the organization can install a patch immediately

Choose all

1 point

Which activities are included in the patch-management process described here? Select all correct answers.

A
Identify updates
B
Prioritize updates
C
Acquire updates
D
Install updates
E
Verify updates
F
Treat installation as complete without checking whether the update worked

True or false

1 point

True or false: Evidence in CISA's Known Exploited Vulnerabilities (KEV) Catalog can support prioritization, but an organization still needs to assess its own systems and risk.

A
True
B
False

Open ended

1 point

Two vulnerabilities have the same high CVSS severity. One is known to be actively exploited and affects an internet-facing business system; the other is present only on an isolated test machine with no sensitive data. Which should usually receive faster attention, and what factors and response steps should guide the decision?

Choose one

1 point

A vulnerable service is accessible from the internet, while another vulnerable device is on a restricted internal network. Which statement best compares their exposure?

A
The device on the restricted internal network is more exposed because it is harder to monitor.
B
The internet-facing service is generally more exposed because potential attackers can reach it more readily.
C
Both assets have equal exposure whenever they contain the same vulnerability.
D
Exposure describes only the technical impact if the vulnerability is exploited.

Choose one

1 point

An organization restricts network access to a vulnerable service but has not changed or patched the software. What is the most accurate conclusion?

A
They remove the vulnerability as soon as they make the asset harder to reach.
B
They can reduce exposure or limit harm, even if the vulnerability remains.
C
They affect severity but cannot affect exposure.
D
They prove that the vulnerable asset is no longer at risk.

Written response

1 point

A team evaluates whether an attacker can launch an attack remotely, whether authentication is required, and whether reliable exploit code is available. Which risk factor is the team assessing?

Choose one

1 point

An organization treats a CVSS score as its complete measure of the risk from a vulnerability. Which correction best reflects the role of CVSS?

A
A CVSS score fully determines organizational risk, regardless of the affected system.
B
CVSS measures only whether an attacker has already compromised the system.
C
CVSS helps express severity, but the organization must consider additional context to assess risk.
D
CVSS scores are useful only when a vulnerability is on an isolated test machine.

Written response

1 point

A team temporarily limits access to a vulnerable asset while a permanent change is pending. What is this type of response called?

Choose one

1 point

A vulnerability scan reports a potentially serious issue, but the team has not confirmed it. What should the team do next?

A
Check important results against reliable vulnerability information and validate them in context.
B
Treat every scanner result as confirmed because scanning eliminates false positives.
C
Discard all scan results because scanners cannot identify useful findings.
D
Prioritize findings solely by how many times the scanner reports them.

Choose one

1 point

When using CVSS, which statement best describes what Threat and Environmental metrics can add beyond Base metrics?

A
Base metrics add exploitation activity; Threat and Environmental metrics describe only confidentiality impact.
B
Environmental metrics replace the need to consider the affected system's configuration.
C
Threat and Environmental metrics can add exploitation activity and information about the affected system's importance or configuration.
D
Threat metrics establish whether the organization has already been compromised.