For Teachers · Back to the Module · Print with your browser's Print command.

A2 Worksheet: Remediation and Verification

Student Worksheet (about 20 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: A1

Learning Objectives

• [ ] Apply a fix with change control and a rollback plan.
• [ ] Verify a fix with a targeted re-scan.
• [ ] Track progress with report diffs.

Key Terms

Write each definition in your own words.

• Remediation: ______________________________________________
• Verification: ______________________________________________
• Change Management: ______________________________________________
• Baseline: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --lab vulnerable --out before && openvapt demo --lab hardened --out after
2. Run: openvapt diff before/report.json after/report.json

Self-Check Questions

1. When is a fix complete?

• [ ] a) When the configuration file is saved
• [ ] b) When it has been verified, for example by a targeted re-scan
• [ ] c) When the ticket is closed
• [ ] d) When the service restarts

1. What does openvapt diff show?

• [ ] a) Fixed, new and still open findings between two reports
• [ ] b) Source code changes
• [ ] c) Network traffic
• [ ] d) Changes in every file on the disk

1. Why keep a second SSH session open while changing SSH or firewall settings?

• [ ] a) To save time
• [ ] b) So you can undo a change that locks you out
• [ ] c) To make the scan faster
• [ ] d) To log more detail

1. Which command re-runs only one check?

• [ ] a) openvapt scan --only HOST-SSH-001
• [ ] b) openvapt diff old.json new.json
• [ ] c) openvapt verify report.json
• [ ] d) openvapt scan --dry-run

1. How many changes should you apply at once?

• [ ] a) All of them together
• [ ] b) One at a time, tested, with a way back
• [ ] c) As many as fit in the maintenance window
• [ ] d) Only the Low findings first

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-40 Rev. 4, Enterprise Patch Management: https://csrc.nist.gov/pubs/sp/800/40/r4/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.