CCP CVE Assessment & Patch Management 3 — Questions and Answers
Question 1: A security team discovers that a vendor patch breaks a critical business application. What is the BEST immediate course of action?
- Apply compensating controls and document a risk acceptance while working with the vendor on a fix (Correct answer)
- Roll back all patches immediately without documentation
- Deploy the patch anyway and accept application downtime
- Wait indefinitely until the vendor resolves the incompatibility
Correct answer: Apply compensating controls and document a risk acceptance while working with the vendor on a fix
When a patch causes incompatibility, applying compensating controls (e.g., WAF rules, network segmentation) and formally accepting residual risk is the recommended risk management approach.
Question 2: Which NVD data field provides a standardized list of weakness types associated with a CVE, helping analysts understand root causes?
- CWE (Common Weakness Enumeration) (Correct answer)
- CPE (Common Platform Enumeration)
- CVSS Base Score
- CAPEC ID
Correct answer: CWE (Common Weakness Enumeration)
CWE entries linked to a CVE describe the underlying software weakness category (e.g., CWE-79 for XSS), aiding root-cause analysis and remediation prioritization.
Question 3: In CVSS v3.1, a vulnerability with Integrity Impact: High means that:
- There is total loss of integrity; the attacker can modify any or all files protected by the vulnerable component (Correct answer)
- Only low-sensitivity data can be modified
- System availability is severely impacted
- Authentication data can be stolen
Correct answer: There is total loss of integrity; the attacker can modify any or all files protected by the vulnerable component
Integrity Impact: High in CVSS v3.1 means the attacker can completely modify protected data or system files, resulting in total loss of integrity.
Question 4: What is the purpose of a 'patch staging environment' in the patch management process?
- To test patches on representative systems before production deployment to catch regressions (Correct answer)
- To store backup copies of original software before patching
- To notify stakeholders about upcoming patches
- To generate compliance reports on patch status
Correct answer: To test patches on representative systems before production deployment to catch regressions
A staging environment mirrors production and is used to validate patches for compatibility and stability before they are pushed to live systems.
Question 5: Which CVSS v3.1 Temporal metric lowers the effective severity when an official vendor fix is available?
- Remediation Level (RL) (Correct answer)
- Exploit Code Maturity (E)
- Report Confidence (RC)
- Attack Complexity (AC)
Correct answer: Remediation Level (RL)
The Remediation Level (RL) temporal metric adjusts the score downward when an official fix exists, distinguishing between unpatched, workaround, and fully remediated states.
Question 6: Which approach prioritizes patching assets based on their exposure to the internet and business criticality?
- Risk-based patch prioritization (Correct answer)
- Chronological patch ordering
- Vendor severity-only ranking
- Alphabetical system patching
Correct answer: Risk-based patch prioritization
Risk-based patch prioritization factors in asset exposure, exploitability (e.g., EPSS score), and business criticality rather than relying solely on vendor severity ratings.
Question 7: What does EPSS (Exploit Prediction Scoring System) provide that CVSS does not?
- A probability estimate that a CVE will be exploited in the wild within the next 30 days (Correct answer)
- A severity score based on technical impact
- A list of affected product versions
- An official vendor patch status
Correct answer: A probability estimate that a CVE will be exploited in the wild within the next 30 days
EPSS produces a daily probability score (0–1) predicting likelihood of exploitation in the wild, complementing CVSS severity with real-world threat intelligence.
CCP CVE Assessment & Patch Management 3
A security team discovers that a vendor patch breaks a critical business application.
What is the BEST immediate course of action?