Vulnerability Management Analyst

Sample question 1

You are a vulnerability management analyst finishing an assessment of Brightleaf Retail's customer portal, where you found that the product search field is vulnerable to SQL injection that lets an unauthenticated user extract the full customer accounts table, including names, hashed passwords, and loyalty-program balances. You are drafting the vulnerability entry for the final report, which both Brightleaf's engineering team and its CISO will read before the readout meeting. Which write-up should you produce?

1. A.A description of the flaw and affected endpoint, the complete set of real customer records recovered during testing pasted in as proof, a severity rating that weighs both technical exploitability and the sensitivity of what was exposed, and a remediation recommendation scoped to Brightleaf's actual query-handling code.
2. B.A description of the flaw and affected endpoint, a redacted or representative example of the extracted data rather than the full record set, a standard published severity score for the SQL injection vulnerability class applied without adjustment for what this instance actually exposed, and a remediation recommendation scoped to Brightleaf's actual query-handling code.
3. C.A description of the flaw and affected endpoint, a redacted or representative example of the extracted data rather than the full record set, a severity rating that weighs both technical exploitability and the sensitivity of what was exposed, and a generic remediation recommendation covering SQL injection prevention in general rather than Brightleaf's specific query-handling code.
4. D.A description of the flaw and affected endpoint, a redacted or representative example of the extracted data rather than the full record set, a severity rating that weighs both technical exploitability and the sensitivity of what was exposed, and a remediation recommendation scoped to Brightleaf's actual query-handling code.

Sample question 2

A vulnerability management analyst at Ashgrove Manufacturing is preparing for the annual security audit and pulls the risk acceptance record for a high severity vulnerability in a legacy inventory application, approved six months ago. The record contains the vulnerability identifier and severity rating, the signature of the business unit risk owner, who holds acceptance authority at this severity under company policy, a written business justification for deferring remediation, and the list of compensating controls that were validated at approval. Since the approval, the application's user base has tripled and it has been connected to a partner ordering portal. Which gap in the record should the analyst flag as most significant before the audit?

1. A.It sets no expiration or reassessment trigger, so nothing forces the acceptance to be revisited even though the application's exposure has changed materially.
2. B.It does not quantify the projected financial loss from exploitation, leaving the deferral justification qualitative rather than expressed in annualized loss terms.
3. C.It carries only the business unit risk owner's signature, without a countersignature from the CISO confirming the acceptance at the executive level.
4. D.It does not map the compensating controls to control identifiers in the company's security framework, forcing auditors to trace that linkage themselves.

Sample question 3

In 2026, while investigating a newly disclosed critical SMB vulnerability affecting several internal file servers, a vulnerability management analyst is asked to help determine whether current network activity shows the vulnerability already being exploited to move between hosts, or is just routine administrative traffic. A packet capture shows one internal workstation opening SMB connections on port 445 to more than 60 other internal hosts within a two-minute span, each connection followed by a nearly identical sequence of protocol-negotiation packets, with no matching change ticket or scheduled maintenance activity. Which characteristic of this traffic most strongly indicates automated exploitation or lateral movement rather than legitimate administrative use?

1. A.The connections targeting port 445, the exact SMB service the newly disclosed critical vulnerability exploits, which is precisely the port an attacker would use to weaponize this flaw against the internal file servers
2. B.One workstation opening SMB sessions to dozens of separate internal hosts within a two-minute window, a rate and spread far beyond what a single user or a scheduled administrative task produces
3. C.Each connection reproducing the same protocol-negotiation packet sequence, a machine-generated uniformity that marks the traffic as automated tooling rather than a human administrator working interactively across the hosts
4. D.The workstation generating only SMB traffic on the file-sharing port rather than a mix of services, showing its activity is concentrated entirely on the protocol that the disclosed vulnerability affects