Section 25.239 Vulnerability Scans

Question 1

Vulnerability Scans

Vulnerability Scan Report

Answer 1

Generated automatically after completing a vulnerability scan

■ Analysis of the report is essential to confirm the validity of identified vulnerabilities

Question 2

False Positives

Answer 2

Vulnerability scanners may produce false positives, meaning they report vulnerabilities that don’t actually exist on your system

■ It is crucial to differentiate real vulnerabilities from false positives

Question 3

Analysis of Vulnerabilities

Answer 3

For each identified vulnerability, assess whether it was detected by the scanner and if it exists on your system

■ Determine the severity and criticality of each vulnerability

■ Create a plan of action and milestones for remediation

Question 4

Components of a Vulnerability Scan Report

Answer 4

■ Report ID
■ Scan Date and Time
■ System or Software Version
■ Scan Initiator: The person who ran the scan
■ Executive Summary: Highlights themes and trends for large networks
■ Vulnerabilities – listed by severity (critical, high, medium, low, informational) or by vulnerable hosts
■ Additional Findings
■ Recommendations
■ Conclusion

Question 5

CVE ID (Common Vulnerability and Exposure)

Answer 5

○ CVE website (cve.org) contains detailed information about vulnerabilities

● Description
● Affected system
● Impact
● Common Vulnerability Scoring System (CVSS) Score
○ Measures severity
● Remediation Recommendations