Vulnerability Management
68 practice questions with explanations — 15 free to try
PassNova has 68 CompTIA CySA+ practice questions on Vulnerability Management, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Vulnerability Management: example questions & answers
3 worked examples with answers and explanations below. Try 15 CompTIA CySA+ questions free in the browser; the full 68-question Vulnerability Management bank is part of PassNova Premium.
In CVSS v3.1, a base score of 9.4 falls into which qualitative severity rating?
- ACritical✓
- BMedium
- CLow
- DNone
Answer: In CVSS v3.1 the Critical band is 9.0 to 10.0, so a base score of 9.4 is rated Critical.
A scanner reports a vulnerability that does not actually exist on the target system. How should this finding be classified?
- ATrue positive
- BFalse negative
- CTrue negative
- DFalse positive✓
Answer: A false positive is a finding that indicates a problem which is not actually present, requiring validation before remediation effort is spent.
An organisation must scan systems without authentication, simulating an external attacker's view. Which scan type meets this need?
- AManual tabletop exercise walking a team through a scenario
- BUnauthenticated (credential-less) scan✓
- CCredentialed scan that logs in with administrator rights
- DSource code SAST scan
Answer: An unauthenticated scan probes systems from the outside without credentials, reflecting what an external attacker could discover.