Qualys Reporting Strategies and Best
Practices (Exam)
In the patch report template, which evaluation provides the most accurate patches that need to be
installed?
(A) Superseded patch evaluation
(B) Latest patch evaluation
(C) QID based patch evaluation
(D) Classic patch evaluation – ✔✔(A) Superseded patch evaluation
Which scorecard report type allows you to identify hosts that are missing required patches and
software?***
(A) Patch report
(B) Vulnerability scorecard report
(C) Missing software report
(D) Asset Search Report – ✔✔(A) Patch report
Which of the following scenarios can lead to gaps in the patch tree structure and break the patch
supersedence logic? Select all that apply.
(A) Scan report with vulnerability search list or Threat Protection RTI filter
(B) Cloud Agent data collection followed by an authenticated scan
(C) Scan job with a custom vulnerability filter
(D) Unauthenticated scan
(E) Cloud Agent scan – ✔✔(A) Scan report with vulnerability search list or Threat Protection
RTI filter
(C) Scan job with a custom vulnerability filter
Identify the vulnerability types excluded by default in the VM/VMDR Dashboard. Select all that
apply.***
(A) Fixed vulnerabilities
(B) Disabled or Ignored vulnerabilities
(C) Vulnerabilities without exploits
(D) Low severity vulnerabilities
(E) Vulnerabilities without patches – ✔✔(A) Fixed vulnerabilities
(B) Disabled or Ignored vulnerabilities
The __ vulnerability type is enabled by default in a new report template.
(A) Confirmed
(B) Potential
(C) Patched
(D) Information Gathered – ✔✔(B) Potential
Stale asset and vulnerability data can affect your security risk and business risk calculations. ***
(A) False
(B) True – ✔✔(B) True
Adding non-Qualys user’s email in the distribution group helps you distribute the scheduled
report to such users. ***
(A) True
(B) False – ✔✔(A) True
When using host-based findings, which of these needs to be turned on to toggle the inclusion of
Fixed vulnerabilities in the report?* (A) Trending (B) (C) (D) – ✔✔(A) Trending Which finding type allows you to include trending data in your reports?*
(A) Scanner based findings
Qualys Patch Management (Course Quizzes)
Which of these is a reason for using a Patch Management solution?
(A) To monitor logs on the asset
(B) To scan for viruses
(C) To close open ports and services
(D) To address vulnerabilities – ✔✔(D) To address vulnerabilities
Which of these Qualys solutions would you use to address vulnerabilities on your assets?
(A) Vulnerability Management
(B) Patch Management
(C) Endpoint Detection and Response
(D) Policy Compliance – ✔✔(B) Patch Management
Which of these sensors does Qualys use to deploy patches?
(A) Scanner appliances
(B) Cloud connectors
(C) Passive sensor
(D) Cloud agent – ✔✔(D) Cloud agent
Which of these actions is commonly performed after deploying patches?
(A) Asset is decommissioned
(B) Asset is scanned
(C) Asset is rebooted
(D) Asset is reimaged – ✔✔(C) Asset is rebooted
Which of these is a recommended approach to patching assets?
(A) Uninstall old patches and apply new
(B) Do not apply patches unless necessary
(C) Apply patches on a set of test assets, verify that the patches do not cause issues, and patch
the remaining assets
(D) Apply patches on all assets right away – ✔✔(C) Apply patches on a set of test assets, verify
that the patches do not cause issues, and patch the remaining assets
Qualys Patch Management correlates missing patches with vulnerabilities.
(A) False
(B) True – ✔✔(B) True
Which of these is true about Qualys Patch Management?
QUALYS VMDR TRAINING
Which of the following are benefits of scanning in authenticated mode? (choose 2) – ✔✔
- More vulnerabilities are detected
- Time saved from manually investigating potential vulnerabilities
Which of the following are valid options for scanning targets? (choose 3) – ✔✔ - Asset Groups
- IP addressing
- Asset Tags
What type of scanner appliance (already provisioned within the Qualys Cloud Platform) is ideal
for scanning public facing assets? – ✔✔External Scanner
Which of the following is NOT a component of a vulnerability scan? – ✔✔Host Discovery
Which of the following will have the greatest impact on a half red, half yellow QID? –
✔✔Authentication
What is the maximum number of TCP ports that can participate in the Host Discovery process? –
✔✔20
Which of the following items are used to calculate the Business Risk score for a particular asset
group? (choose 2) – ✔✔Business Impact
Security Risk
In order to successfully perform an authenticated (trusted) scan, you must create a(n): –
✔✔Authentication record
Multiple Remediation Policies are evaluated: – ✔✔from top to bottom
A search list contains a list of . – ✔✔QIDs
Dynamic Asset Tags are updated every time you. – ✔✔Run a scan
As a Manager in Qualys, which activities can be scheduled? – ✔✔Asset Searches
Updates to the KnowledgeBase
Maps
Reports
Scans
What does it mean when a “pencil” icon is associated with a QID in the Qualys KnowledgeBase?
- ✔✔The QID has been edited
Qualys Web Application Scanning (EXAM)
The Malware Monitoring option should only be enabled for:
(A) Applications with a “malware” tag
(B) Internal facing applications
(C) External facing applications
(D) Both internal and external facing applications – ✔✔(C) External facing applications
Where can you “Ignore” a vulnerability for a Web Application? (select two) (Choose all that
apply)
(A) Scorecard Report
(B) Scan Report
(C) Web Application Report
(D) Detections Tab – ✔✔(B) Scan Report
(D) Detection Tab
A Search List contains a list of:
(A) Username/Password combinations
(B) QIDs from the Qualys KnowledgeBase
(C) Crawling hints
(D) Common input parameters – ✔✔(B) QIDs from the QualysBase
When launching a Web Application Scan, you have the option to override some default settings.
Which of the following options can NOT be overridden?
(A) Option Profile
(B) Crawl Scope
(C) Scanner Appliance
(D) Authentication Record – ✔✔(D) Authentication Record
What attack proxies can you integrate with Qualys WAS?
(A) BURP
(B) W3af
(C) ZAP
(D) WebScarab – ✔✔(A) BURP
How can you get your scan to follow a business workflow (such as a shopping cart transaction)?
(A) Use a Selenium Script to record and replay the workflow
(B) Use a Custom Authentication Record
(C) Use a Crawl Exclusion List
(D) Use DNS Override – ✔✔(A) Use a Selenium Script to record and replay the workflow
Qualys Cloud Agent Exam
Identify the Qualys application modules that require Cloud Agent. (Choose all that apply)
(A) EDR
(B) VM
(C) PM
(D) FIM – ✔✔(A) EDR
(C) PM
(D) FIM
A Cloud Agent status indicates the agent uploaded new host data, and an assessment of the host
was performed within the Qualys Cloud Platform. Which one from the following options is it?
(A) Scan Complete
(B) Provisioned
(C) Manifest Downloaded
(D) Configuration Downloaded – ✔✔(A) Scan Complete
From all the tasks associated with the Provisioning stage, identify the one that is not among
them.
(A) Agent attempts to connect to the Qualys Platform (with valid CustomerID and
AcctivationID)
(B) Agent performs an initial assessment scan
(C) Agent is validated by the Qualys platform
(D) Agent generates its Qualys Host ID or re-provisions its Qualys Host ID for cloned images –
✔✔(B) Agent performs an initial assessment scan
Recall and state the task that is NOT performed by Cloud Agent.
(A) Check-in to the Qualys Platform at regular intervals
(B) Transfer data payloads to the Qualys Platform
(C) Assessment Testing
(D) Data collection – ✔✔(C) Assessment Testing
The VM Scan Interval option of the Configuration Profile allows you to perform which task?
(A) Configure frequency for SCA scan
(B) Configure frequency for VM scan
(C) Configure frequency for policy compliance scan
(D) Configure Agent status interval – ✔✔(A) Configure frequency for SCA scan
Identify the query that will help you find agents that have not checked-in within the last 7 days.
Qualys Patch Management (PM) Exam
Using the “Search” field (found in the VULNERABILITIES section of the VM Dashboard),
which query will produce a list of “patchable” vulnerabilities?
(A)vulnerabilities.vulnerability.qualysPatchable:TRUE
(B)vulnerabilities.vulnerability.qualysPatchable:FALSE
(C)vulnerabilities.vulnerability.isPatchable:FALSE
(D)vulnerabilities.vulnerability.isPatchable:TRUE –
✔✔(D)vulnerabilities.vulnerability.isPatchable:TRUE
Which of the following conventions can be used to include or assign host assets to a job? (choose
2) (Select all that apply)
(A) Asset Name
(B) Asset Group
(C) Business Unit
(D) Asset Tag – ✔✔(A) Asset Name
(D) Asset Tag
The __ process is responsible for installing and uninstalling patches, included in patch
jobs you create.
(A) stdeploy.exe
(B) Qualys Cloud Agent
(C) notify.exe
(D) Qualys Cloud Agent UI – ✔✔(B) Qualys Cloud Agent
What does it mean, when a patch is displayed with a “key-shaped” symbol?
(A) The patch is a key requirement for the deployment of other patches.
(B) The patch cannot be downloaded by Qualys Cloud Agent.
(C) The patch has been deprecated.
(D) The patch cannot be uninstalled. – ✔✔(B) The patch cannot be downloaded by Qualys Cloud
Agent.
Within a PM Assessment Profile, what is the minimum value, for patch assessment frequency?
(A) 24 hours
(B) 4 hours
(C) 12 hours
(D) 1 hour – ✔✔(A) 24 hours
Which of the following Qualys applications or services, provide the ability to create a patch job?
(choose 3) (Choose all that apply)
Qualys Vulnerability Management v1
Which of the following are benefits of scanning in authenticated mode? (choose 2)
- Fewer confirmed vulnerabilities
- More vulnerabilities are detected
- Time saved from manually investigating potential vulnerabilities
- More accurate scan details
- ✔✔- More vulnerabilities are detected
- Time saved from manually investigating potential vulnerabilities
Which of the following are valid options for scanning targets? (choose 3). - Asset Groups
- Domain Name
- IP addressing
- Asset Tags
- Search Lists
- MAC Address – ✔✔- Asset Group
- IP Addressing
- Asset Tags
What type of scanner appliance (already provisioned within the Qualys Cloud Platform) is ideal
for scanning public facing assets?
- Offline Scanner
- Virtual Scanner
- External Scanner
- Internal Scanner – ✔✔External Scanner
- Which of the following is NOT a component of a vulnerability scan?
- Host Discovery
- OS Detection
- Port Scanning
- Business Impact – ✔✔Host Discovery
Which of the following will have the greatest impact on a half red, half yellow QID? - Share Enumeration
- Scan Dead Hosts
- Authentication
- Authoritative Option – ✔✔Authentication
What is the maximum number of TCP ports that can participate in the Host Discovery process?