CCP CVE Assessment & Patch Management 2

Question 1

Which CVSS v3.1 metric describes whether an attacker needs to be on the same network segment as the vulnerable component?

Accepted Answer

Attack Vector: Adjacent

Answer

The 'Adjacent' value for Attack Vector means the attacker must be on the same physical or logical network as the target, such as Bluetooth or a local subnet.

Question 2

A patch released outside of the normal patch cycle to address a critical zero-day vulnerability is called a:

Accepted Answer

Hotfix or out-of-band patch

Answer

An out-of-band or hotfix patch is released urgently outside the scheduled patch cycle to address actively exploited or critical vulnerabilities.

Question 3

What does the CVE identifier format CVE-2023-12345 indicate?

Accepted Answer

The vulnerability was assigned in 2023 with sequence number 12345

Answer

CVE identifiers follow the format CVE-[year]-[sequence], where the year reflects when the CVE ID was assigned, not when the vulnerability was discovered or patched.

Question 4

In patch management, what is a 'patch window'?

Accepted Answer

A scheduled maintenance period when patches are applied to minimize disruption

Answer

A patch window is a predetermined maintenance window during which IT teams apply patches to minimize impact on business operations.

Question 5

Which organization is the primary CVE Numbering Authority (CNA) responsible for assigning CVE IDs to vulnerabilities in Microsoft products?

Accepted Answer

Microsoft Corporation

Answer

Microsoft is a CVE Numbering Authority (CNA) and assigns CVE IDs for vulnerabilities discovered in its own products, while MITRE oversees the overall CVE program.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP CVE Assessment & Patch Management 2