Vulnerability Management Exam with accurate detailed solutions

2


Vulnerability Management Exam with accurate detailed || || || || || ||




solutions


vulnerability
A flaw or weakness that allows a threat agent to bypass security.
|| || || || || || || || || || ||




0-Day Vulnerability (Zero Day)
|| || ||




A vulnerability that is not known to the software developer or vendor, but is known to an attacker
|| || || || || || || || || || || || || || || || ||




Resources to information about vulnerabilities || || || ||




NIST National Vulnerability Database
|| || ||




MITRE CVE ||




FEEDLY
Twitter




CVSS (Common Vulnerability Scoring System)
|| || || ||




A risk management approach to quantifying vulnerability data and then taking into account the
|| || || || || || || || || || || || || ||




degree of risk to different types of systems or information.
|| || || || || || || || ||




3.0
Generate a score from 0-10 based on intrinsic characteristics of the vuln.
|| || || || || || || || || || ||




0 = none
|| ||




0.1=3.9 = low || ||




4.0-6.9 = medium || ||




7.0 - 8.9 -= high
|| || || ||

, 2


9.0+ = critical || ||




CVE (Common Vulnerabilities and Exposures)
|| || || ||




dictionary that provides a central repository of sec vuln's and issues
|| || || || || || || || || ||




Each CVE # represents a specific vulnerability
|| || || || || ||




Types of Vulnerability Scans || || ||




▪ Discovery scan
|| ||




▪ Full scan
|| ||




▪ Stealth scan
|| ||




▪ Compliance scan
|| ||




▪Passive Scan ||




▪Active Scan ||




▪Credentialed Scan ||




▪Non-credentialed scan ||




▪Agent-Based Scan ||




▪Assessment Scan ||




Discovery Scan ||




A type of vulnerability scan that is primarily meant to identify the attack surface of a target. A
|| || || || || || || || || || || || || || || || || ||




port scan is a major part of a discovery scan.
|| || || || || || || || ||




AKA