Vulnerability scanning, CVE, CVSS scoring, patch cycles, risk prioritization, penetration testing versus scanning and bug bounties.
34 cards · basic cards · AI-written, checked twice. Edit anything.
- What is a vulnerability scan?
Show answer
A systematic automated assessment to identify security weaknesses in systems, applications, or networks.- Name three common vulnerability scanning tools.
Show answer
Nessus, OpenVAS, Qualys, Rapid7 InsightVM, or Tenable.io.- What does CVE stand for?
Show answer
Common Vulnerabilities and Exposures.- What is a CVE identifier?
Show answer
A unique reference number assigned to a publicly disclosed vulnerability, formatted as CVE-YYYY-NNNNN.- What does CVSS stand for?
Show answer
Common Vulnerability Scoring System.- What is the purpose of CVSS?
Show answer
To provide a standardized, reproducible method for scoring vulnerability severity.- What is the CVSS base score range?
Show answer
0.0 to 10.0.- What does a CVSS score of 0.0 represent?
Show answer
No vulnerability or no security impact.- What does a CVSS score of 10.0 represent?
Show answer
Maximum severity, a critical vulnerability requiring immediate remediation.- What are the three metric groups in CVSS v3.1?
Show answer
Base, Temporal, and Environmental.- What does the Base metric group measure in CVSS?
Show answer
The intrinsic characteristics of a vulnerability that remain constant over time.- What does the Temporal metric group measure in CVSS?
Show answer
Characteristics that change over time, such as exploit availability and patch status.- What does the Environmental metric group measure in CVSS?
Show answer
The impact and scope specific to an organization's own environment and assets.- What does Attack Vector measure in CVSS?
Show answer
Whether a vulnerability can be exploited locally, across the network, or adjacent to the network.- What does Privileges Required measure in CVSS?
Show answer
Whether an attacker must have elevated or administrative permissions to exploit the vulnerability.
FlashKeepers