Reading the output of vulnerability assessment tools

Key: C

1. AMetasploit exploits vulnerabilities; it can call a port scan, but it is not the standard port-discovery tool.
2. BBurp Suite tests web applications through an intercepting proxy; it does not scan a server's network ports.
3. CCorrect: Nmap probes hosts to find open ports, running services and versions, and often the operating system.
4. DWireshark passively captures and analyzes traffic; it does not probe a server for open ports.

Key: C

1. ABurp Suite is a commercial web application testing proxy (with a free Community edition), so it is neither open source nor a general vulnerability scanner.
2. BNmap discovers hosts, ports, and services; its scripts can check some vulnerabilities, but it is not a full vulnerability assessment platform.
3. CCorrect: OpenVAS is the open-source scanner (part of Greenbone) that runs a large feed of vulnerability tests against hosts and services.
4. DWireshark analyzes captured network traffic; it does not scan for vulnerabilities.

Key: B

1. AWireshark captures and analyzes packets but does not test services for vulnerabilities or misconfigurations.
2. BCorrect: Nessus is a vulnerability scanner that checks network services for known vulnerabilities, outdated versions, and configuration weaknesses.
3. CTrueCrypt was a disk encryption tool, now discontinued, and has nothing to do with scanning.
4. DKali Linux is a distribution that bundles many tools, so it is a platform and no specific vulnerability scanner.

Key: D

1. ACompliance reporting uses vulnerability data, but producing auditor reports is not the purpose of correlation.
2. BPrioritizing by CVSS alone ignores context, and correlation is about linking findings instead of ranking them by one score.
3. CAssigning tasks to people is workflow management, which comes after findings are understood and prioritized.
4. DCorrect: Correlation links findings across systems to reveal shared weaknesses, such as one bad image or configuration baseline, so the root cause can be fixed once.

Key: B

1. ATreating the two DB-01 records as separate issues double-counts one vulnerability; duplicates should be merged.
2. BCorrect: After the DB-01 duplicates are merged, the high-confidence agent result (CVSS 9.8) wins over the weaker network result, making it the top-priority fix.
3. CLow evidence lowers confidence in the App-03 finding, which argues for verifying it before anyone fixes it first.
4. DSorting raw findings by CVSS without merging duplicates or considering evidence quality ignores the normalization the scenario asks for.

Key: B

1. AThe banner on app02 shows a patched build, so this finding is probably a false positive and cannot be called a probable true positive.
2. BCorrect: A version string that matches a known vulnerable build is strong evidence, so app01 should get credentialed validation right away to confirm it, for example to rule out a backported patch.
3. CA service answering a non-credentialed probe proves only that it is reachable; vulnerability is still unproven.
4. DA timed-out plugin gave no evidence at all, so this result is inconclusive rather than a probable true positive.

Key: B

1. ARemediating every non-credentialed finding without verification wastes effort on false positives.
2. BCorrect: Non-credentialed scans guess from banners and responses, so remote RCE findings that the credentialed scan does not confirm should be checked with a credentialed rescan and configuration review.
3. CA high CVSS score says how serious a vulnerability would be and says nothing about whether a non-credentialed detection is accurate.
4. DThe two modes differ in accuracy; credentialed results are more reliable, so results that conflict need verification.

Key: D

1. AWaiting a year leaves a high-severity finding unaddressed, which breaks remediation SLAs.
2. BEmergency patching of an OT asset based on an often-wrong finding risks outages in a safety-critical environment.
3. CAnother non-credentialed scan reproduces the same false-positive problem, and more aggressive scans can disrupt fragile OT devices.
4. DCorrect: Credentialed verification during a planned maintenance window confirms the finding safely, and only then is it escalated for remediation.

Key: C

1. ARebuilding with updated pip requirements fixes the High-severity requests library CVE in L4 but leaves the Critical libcrypto flaw in the base layer.
2. BThe apk add layer had no findings; it installs Python and does not contain the vulnerable libcrypto.
3. CCorrect: The Critical libcrypto flaw comes from the alpine:3.14 base image, so the FROM line must point to a patched, newer base image and the image must be rebuilt.
4. DThe COPY layer adds application files and had no findings, so changing it does not fix the base-image vulnerability.

Key: C

1. ACVSS alone ignores exploit maturity, whether the package actually runs, and exposure, which are the facts that set real priority.
2. BA proof-of-concept exploit on an internal system is a real concern, but it is less urgent than a mature exploit on a public-facing runtime package.
3. CCorrect: A mature exploit for a package that is loaded at runtime in a publicly exposed image is the most likely to be exploited, so it gets top priority.
4. DNo known exploit, a package not used at runtime, and internal-only exposure make this the lowest priority.

Key: B

1. AApp-02 has a 9.8 CVSS score, but it is reachable only from the internal network and has read-only DynamoDB rights, so the attack path is weaker.
2. BCorrect: Data-01 is internet-facing and has AdministratorAccess, so exploiting even a 7.5 vulnerability could give an attacker control of the whole cloud account.
3. CQueue-01 has the lowest score and is reachable only internally, even though SSH is open.
4. DWeb-01 is internet-facing with a 9.8 score, but its read-only S3 permission limits what an attacker can do after compromise.

Key: B

1. AAutomated scanning usually costs less than manual testing, which is why organizations use it widely.
2. BCorrect: Scanners find known issues by signature or rule, but they cannot understand business logic, so flaws like broken workflows or authorization logic errors need human testing.
3. CModern scanners have extensive reporting features, so reporting is not their key limitation.
4. DWireless assessment tools exist, and wireless coverage is a scope choice instead of the main limitation of automation.

Key: C

1. ANuclei detects with templates; the line reports a match, not that the repository was downloaded.
2. BThe template checks for an exposed config file over HTTP, not for a vulnerable Git server version.
3. CCorrect: Nuclei reports which template matched, the protocol, its severity and the URL where the match occurred.
4. DNothing in the output mentions credentials; it shows only that the config file can be reached.

Key: B

1. AScoutSuite audits the configuration of live cloud accounts; it does not scan images or Terraform in a pipeline.
2. BCorrect: Trivy scans container images for vulnerable packages and IaC files such as Terraform for misconfigurations.
3. CNikto checks running web servers for known issues; it does not read container images or IaC files.
4. DRecon-ng is a reconnaissance framework for open-source intelligence, not an image or IaC scanner.

Key: A

1. ACorrect: Atomic Red Team is a library of small tests mapped to ATT&CK techniques, used to check that detections fire.
2. BNessus finds vulnerabilities and misconfigurations; it does not emulate adversary techniques to test detections.
3. CMetasploit is built to exploit vulnerabilities; its modules are not a library of ATT&CK-mapped detection tests.
4. DOpenVAS is a vulnerability scanner, so it reports weaknesses rather than exercising detection rules.