CCP CVE Assessment & Patch Management 3

Question 1

A security team discovers that a vendor patch breaks a critical business application. What is the BEST immediate course of action?

Accepted Answer

Apply compensating controls and document a risk acceptance while working with the vendor on a fix

Answer

When a patch causes incompatibility, applying compensating controls (e.g., WAF rules, network segmentation) and formally accepting residual risk is the recommended risk management approach.

Question 2

Which NVD data field provides a standardized list of weakness types associated with a CVE, helping analysts understand root causes?

Accepted Answer

CWE (Common Weakness Enumeration)

Answer

CWE entries linked to a CVE describe the underlying software weakness category (e.g., CWE-79 for XSS), aiding root-cause analysis and remediation prioritization.

Question 3

In CVSS v3.1, a vulnerability with Integrity Impact: High means that:

Accepted Answer

There is total loss of integrity; the attacker can modify any or all files protected by the vulnerable component

Answer

Integrity Impact: High in CVSS v3.1 means the attacker can completely modify protected data or system files, resulting in total loss of integrity.

Question 4

What is the purpose of a 'patch staging environment' in the patch management process?

Accepted Answer

To test patches on representative systems before production deployment to catch regressions

Answer

A staging environment mirrors production and is used to validate patches for compatibility and stability before they are pushed to live systems.

Question 5

Which CVSS v3.1 Temporal metric lowers the effective severity when an official vendor fix is available?

Accepted Answer

Remediation Level (RL)

Answer

The Remediation Level (RL) temporal metric adjusts the score downward when an official fix exists, distinguishing between unpatched, workaround, and fully remediated states.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP CVE Assessment & Patch Management 3