Free Vulnerability Management practice questions

An external scan runs from the internet against public addresses, and a non-credentialed scan probes services the way an outsider would, so together they show an internet attacker's view. Internal and credentialed scans show what someone with a foothold or a login sees, agents see each host from inside, and CSPM reads cloud account settings.

An agent runs the checks on the laptop itself wherever it is and sends results when it's online, which is why agents matter most for remote staff. Scanning more often still misses laptops that aren't connected, scanning home addresses means probing networks the company doesn't own, and CSPM reads cloud account settings rather than laptop patches.

Any flaw on a subnet the scanner never looks at is invisible to the program, so closing that coverage gap comes first, ideally by having the scanner pull its targets from IPAM automatically. Credentials and frequency improve scans of hosts already covered, and removing the subnets from IPAM would hide them rather than assess them.

A false negative is a real flaw the scanner doesn't report, and checks that don't exist yet for a newly disclosed flaw are a common cause. It isn't a true negative, because the flaw was there, and false positives and true positives both require the scanner to have reported something.

This is a logic flaw: the API confirms the user is signed in but never checks that the order belongs to them, and reviewers reading authorization code catch that kind of problem where tools don't. SAST understands business logic poorly, a credentialed scan checks installed software for known flaws, and CSPM evaluates cloud settings, so none of them knows who should own an order.

The scanner's rating is the CVSS base score for a generic deployment, and the analyst adjusts it for context: evidence of exploitation such as a KEV listing and highly sensitive data both push the priority up. Writing the reasons down shows an auditor or the next analyst why it moved. Being internal is one factor, not a reason to discount known exploitation, and nothing suggests a false positive.

Scope and methodology records what was tested, when and from where, under which rules of engagement, and what was excluded, which is what an auditor checking coverage needs. The executive summary gives leadership the overall risk, reproduction steps tell engineers how to trigger an issue, and recommendations describe fixes.

The debug page is the quickest link to remove, and the password it exposed may already be in an attacker's hands, so both happen now; rotating while the page is still up would only expose the new password. The rest of the chain gets fixed too, because an attacker may find another route around a single fix. Fixing only the page leaves a possibly stolen password working, waiting for the retest leaves the path open, and ranking each issue alone misses that the chain is what makes them dangerous.

A finding without evidence goes back to the testing firm for clarification rather than straight into the queue. Assigning it unverified skips that check, closing it as a false positive needs evidence that the flaw isn't there, and a clean non-credentialed scan proves little about a flaw in an application's logic.

A penetration test report is a step-by-step account of how to compromise the organization, so it stays confidential and need-to-know, and the ticket points to the evidence in the secured report instead of carrying it. Attaching the report, pasting the password or copying the attack steps exposes all of that to everyone who can read the queue.