M05 · Vulnerability Analysis · Q&A

Check understanding with original scenarios and a reason for every option. These answers do not establish exam or practical readiness.

Scenario questions

ceh-m05-risk-q1 · Original practice

Must the higher CVSS score always be fixed first?

Must the higher CVSS score always be fixed first? A. Yes; the number is sufficientB. No; exposure, threats and impact also matterC. No; scores are uselessD. Yes; applicability need not be checked

Confidence

JavaScript is off: read the answer and explanation

One severity score is not a complete risk decision.
Context informs operational priority.
Scores are useful within their scope.
An inapplicable version match may be a false finding.

ceh-m05-risk-q2 · Original practice

A scanner flags a candidate CVE from a version string alone. How should it be recorded?

A scanner flags a candidate CVE from a version string alone. How should it be recorded? A. Confirmed compromiseB. Remediation completeC. Candidate vulnerability; applicability pendingD. Proof the product has no risk

Confidence

JavaScript is off: read the answer and explanation

No exploitation or compromise evidence is given.
No fix or validation occurred.
This retains both the detection and its limit.
A candidate finding does not establish safety.

ceh-m05-risk-q3 · Original practice

After restricting source access without patching, what is the most accurate state?

After restricting source access without patching, what is the most accurate state? A. Exposure partially mitigated; patching remains openB. The vulnerability no longer existsC. All records may be deletedD. Every attack path is blocked

Confidence

JavaScript is off: read the answer and explanation

Control effectiveness and vulnerability removal need separate verification.
The rule did not change the affected software.
Handling and validation records remain necessary.
One rule does not establish that all paths are gone.

Continue to safe practice →

CS Kairos Research and learning, built over time.

Teaching & main site Content principles GitHub