CCP CVE Assessment & Patch Management 2 — Questions and Answers
Question 1: Which CVSS v3.1 metric describes whether an attacker needs to be on the same network segment as the vulnerable component?
- Attack Vector: Adjacent (Correct answer)
- Attack Vector: Local
- Attack Vector: Network
- Privileges Required: Low
Correct answer: Attack Vector: Adjacent
The 'Adjacent' value for Attack Vector means the attacker must be on the same physical or logical network as the target, such as Bluetooth or a local subnet.
Question 2: A patch released outside of the normal patch cycle to address a critical zero-day vulnerability is called a:
- Hotfix or out-of-band patch (Correct answer)
- Rollup patch
- Feature update
- Service pack
Correct answer: Hotfix or out-of-band patch
An out-of-band or hotfix patch is released urgently outside the scheduled patch cycle to address actively exploited or critical vulnerabilities.
Question 3: What does the CVE identifier format CVE-2023-12345 indicate?
- The vulnerability was assigned in 2023 with sequence number 12345 (Correct answer)
- The vulnerability severity score is 12,345
- The CVE was patched in 2023
- The vendor ID is 12345
Correct answer: The vulnerability was assigned in 2023 with sequence number 12345
CVE identifiers follow the format CVE-[year]-[sequence], where the year reflects when the CVE ID was assigned, not when the vulnerability was discovered or patched.
Question 4: In patch management, what is a 'patch window'?
- A scheduled maintenance period when patches are applied to minimize disruption (Correct answer)
- A vulnerability in the patching software itself
- The time between vulnerability disclosure and patch release
- A GUI tool for reviewing patches
Correct answer: A scheduled maintenance period when patches are applied to minimize disruption
A patch window is a predetermined maintenance window during which IT teams apply patches to minimize impact on business operations.
Question 5: Which organization is the primary CVE Numbering Authority (CNA) responsible for assigning CVE IDs to vulnerabilities in Microsoft products?
- Microsoft Corporation (Correct answer)
- MITRE
- NIST
- US-CERT
Correct answer: Microsoft Corporation
Microsoft is a CVE Numbering Authority (CNA) and assigns CVE IDs for vulnerabilities discovered in its own products, while MITRE oversees the overall CVE program.
Question 6: When evaluating a CVE, the 'Scope' metric in CVSS v3.1 set to 'Changed' means:
- The vulnerability impacts components beyond the vulnerable component's authorization scope (Correct answer)
- The attacker's privileges change after exploitation
- The patch changes the system's security configuration
- The vulnerability scope changes between versions
Correct answer: The vulnerability impacts components beyond the vulnerable component's authorization scope
A 'Changed' Scope indicates that exploitation can affect components with different authorization scope, such as a VM escape affecting the hypervisor.
Question 7: Which patch management metric measures the average time from patch availability to deployment across all systems?
- Mean Time to Patch (MTTP) (Correct answer)
- Mean Time to Detect (MTTD)
- Patch Compliance Rate
- Vulnerability Density
Correct answer: Mean Time to Patch (MTTP)
Mean Time to Patch (MTTP) measures the average elapsed time from when a patch becomes available to when it is deployed across target systems.
CCP CVE Assessment & Patch Management 2
Which CVSS v3.1 metric describes whether an attacker needs to be on the same network segment as the vulnerable component?