CISA Practice Test

CISA practice test: what's covered

• CISA KEV
• BOD 26-04
• SSVC
• CVSS v4
• EPSS
• Remediation Governance

Free CISA sample questions

1. A SOC analyst sees a CVE on the CISA Known Exploited Vulnerabilities catalog with a due date ten days away. What should the vulnerability team do first?

   • A. Confirm affected asset ownership, exposure, vendor remediation action, and assign a tracked remediation owner before the due date
   • B. Wait for the next monthly scanner cycle because catalog entries are only informational for defenders
   • C. Close the record if the CVSS base score is below critical severity
   • D. Create a general awareness ticket without checking whether any enterprise asset is affected
   Show answer

   Correct: A. CISA KEV is evidence of known exploitation and includes an expected remediation action. The first move is scoped asset validation and ownership, not waiting for routine scans or downgrading solely because a base score is not critical.

2. A federal contractor consumes the KEV JSON feed daily. Which field should trigger the strongest workflow compared with an ordinary scanner finding?

   • A. The catalog entry showing known exploitation and a required action or mitigation path
   • B. The alphabetical order of the vendor name in the feed
   • C. The product name length compared with other catalog rows
   • D. The presence of a generic description without checking asset inventory
   Show answer

   Correct: A. The distinguishing signal is known exploitation plus an action path, which changes prioritization and governance. Formatting details or unscoped descriptions do not prove enterprise exposure or remediation priority.

3. A security lead is building an intake checklist for a new KEV entry. Which TWO items belong in the first-hour checklist? (Choose TWO)

   • A. Map the CVE to asset inventory, internet exposure, and business owner records
   • B. Record the CISA due date, vendor action, and temporary mitigation options
   • C. Suppress all scanner plugins until the official patch is older than 30 days
   • D. Assume every product version in the company is vulnerable without evidence
   • E. Use only an executive dashboard color to decide the remediation sequence
   Show answer

   Correct: A and B. A practical intake checklist needs ownership, exposure, deadline, and remediation or mitigation evidence. Suppressing plugins, assuming universal exposure, or using dashboard color alone creates blind prioritization.

4. A KEV item names a cloud service, but the company uses only the self-hosted product with a different major version. What is the best next step?

   • A. Validate affected versions and deployment model against the vendor advisory before declaring the finding applicable
   • B. Mark it exploitable because any product with a similar name is always affected
   • C. Ignore it permanently because CISA catalog entries apply only to government systems
   • D. Patch unrelated servers immediately without confirming whether the software exists there
   Show answer

   Correct: A. KEV proves exploitation of a vulnerability, not automatic exposure of every similarly named deployment. Applicability still depends on affected version, product edition, hosting model, and compensating controls.

5. A scanner reports 4,000 critical findings and three KEV matches. What is the strongest triage approach?

   • A. Prioritize confirmed KEV-exposed assets first while continuing risk-based handling of the remaining critical findings
   • B. Sort only by plugin publication date and ignore exploitation evidence
   • C. Patch the easiest low-risk servers first to improve closure count
   • D. Freeze all remediation until every scanner false positive is manually removed
   Show answer

   Correct: A. Known exploitation should raise urgency once assets are confirmed affected. Closure count, plugin age alone, or waiting for a perfect scanner queue can leave actively exploited exposure open.

Last updated: 2026-10-19

CISA practice test FAQ