4 Vulnerability Management Online Quiz Questions

True

False

They show only what an outside observer can reach.

They can inspect more system details than unauthenticated scans.

They identify vulnerable third-party packages that network scans cannot see.

They verify that a patch deployment has completed successfully.

True

False

Address the test system first because its finding has a higher severity score.

Give both findings the same priority because severity scores determine organizational risk.

Address the exposed business-critical server first, considering its KEV listing and context.

Defer both findings until the next scan because scan results are not definitive.

Use software composition analysis to identify vulnerable third-party libraries and packages.

Assess cloud resources and configurations for insecure settings and known software flaws.

Review security advisories, vendor notices, and threat intelligence.

Assume a network vulnerability scan will reveal every vulnerable software dependency.

Use penetration tests and responsible vulnerability reports as complementary sources of findings.

Limit inventory to internet-facing services because internal assets do not affect exposure.

Maintain an inventory of operated assets and connect findings to accountable owners.

Scan once, then stop discovery unless a vulnerability is reported externally.

Treat assets omitted from scans as out of scope for vulnerability management.

Whether exploitation is observed or the vulnerability is listed in KEV.

Whether exploit code is available and what threat intelligence indicates.

Whether the affected asset is internet-facing, business-critical, sensitive, or a path to other systems.

Whether the vulnerable component is reachable and enabled, and whether safeguards reduce exposure.

The potential effects on safety, confidentiality, integrity, or essential operations.

Close the finding as soon as the installation request is submitted.

Close the finding once the patch is installed, without checking the affected asset.

Check only whether the patch package was acquired.

Rescan or retest the asset and confirm its version or configuration no longer leaves the component exposed.

True

False

Increase the scan frequency for the servers already listed, without changing the asset list.

Build and maintain an inventory that includes cloud resources, then include those assets in discovery.

Prioritize only findings with the highest technical severity score.

Close findings for unlisted assets until a system owner reports them.

Treat every scanner result as confirmed and immediately close the investigation.

Rely on the severity score alone to determine whether the product is affected.

Confirm the product and version, check whether the vulnerable feature is enabled or reachable where relevant, and investigate possible false positives.

Wait for the next scheduled scan before checking any details about the finding.

Deploy the change immediately to every system and address any service impact afterward.

Assign an owner, test the change where practical, schedule deployment, plan for service availability and rollback, and record completion.

Ask the scanner operator to install the patch without involving the system owner.

Wait until the next vulnerability scan to decide whether the patch should be deployed.

Disable the affected feature or restrict access, track the temporary safeguard, and plan a permanent fix where feasible.

Mark the vulnerability fixed because the patch cannot currently be deployed.

Accept the risk informally and remove the finding from tracking.

Continue operating without safeguards until a patch becomes available.