Start Here
Five review stations, each a different way to practice Chapter 12. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or the exam.
What this chapter asked you to be able to do
- Explain the vulnerability management lifecycle: identify, analyze, prioritize, remediate, and verify.
- Tell apart credentialed and non-credentialed scans, and interpret scan results, including false positives and false negatives.
- Read a CVSS (Common Vulnerability Scoring System) score, understand what its base factors measure, and know its limits.
- Describe SIEM (Security Information and Event Management) concepts: log aggregation, normalization, correlation, and alerting.
- Explain baselines, anomaly detection, threat hunting, and indicators of compromise, and the role of patch management.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Matching Tasks to Lifecycle Phases
The vulnerability management lifecycle runs in five phases: identify, analyze, prioritize, remediate, and verify. Read each task and choose the phase it belongs to, then check your answer.
Reference: the five phases
| Phase | What it does | Example activity |
|---|---|---|
| Identify | Discovers vulnerabilities | Scanning, code review, configuration auditing |
| Analyze | Assesses severity and exploitability | Confirm a finding is real, judge business context |
| Prioritize | Ranks which to fix first | Combine CVSS with system criticality into a risk score |
| Remediate | Applies the fix | Patch, configuration change, compensating control, decommission |
| Verify | Confirms the fix worked | Rescan, manual test, change verification |
Verification closes the loop. If a vulnerability remains, the cycle begins again to determine why the remediation failed.
Matching Descriptions to Scanning and Scoring Concepts
This station covers how vulnerabilities are discovered and scored: credentialed and non-credentialed scans, false positives and false negatives, and the CVSS score and its attack vector factor. Read each description and choose the concept it defines.
Reference: CVSS severity ratings
| Score range | Severity | Response time |
|---|---|---|
| 9.0 to 10.0 | Critical | Immediate (same day) |
| 7.0 to 8.9 | High | Days to weeks |
| 4.0 to 6.9 | Medium | Weeks to months |
| 0.1 to 3.9 | Low | Normal maintenance cycle |
| 0.0 | None | No action required |
CVSS measures technical severity. It does not account for business context or whether an exploit is actively circulating, so organizations supplement it with a business risk assessment.
Matching Descriptions to Monitoring Concepts
Match each description to the monitoring concept it defines: log aggregation, normalization, correlation, baseline, anomaly detection, threat hunting, and indicator of compromise.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.