CDP Threat Modeling & Vulnerability Management 2 — Questions and Answers
Question 1: What is the scoring range for CVSS (Common Vulnerability Scoring System) base scores?
- 1 to 100
- 0.0 to 10.0 (Correct answer)
- 1 to 10
- 0 to 5
Correct answer: 0.0 to 10.0
CVSS base scores range from 0.0 to 10.0, with 10.0 representing the most severe vulnerabilities requiring the most urgent remediation.
Question 2: What does CVE stand for in the context of vulnerability management?
- Common Vulnerability Enumeration
- Critical Vulnerability Exposure
- Common Vulnerabilities and Exposures (Correct answer)
- Centralized Vulnerability Engine
Correct answer: Common Vulnerabilities and Exposures
CVE (Common Vulnerabilities and Exposures) is a standardized list of publicly known security vulnerabilities maintained by MITRE Corporation.
Question 3: Which open-source tool is widely used in DevSecOps pipelines to scan container images for known vulnerabilities?
- SonarQube
- Trivy (Correct answer)
- Burp Suite
- Metasploit
Correct answer: Trivy
Trivy, developed by Aqua Security, is a comprehensive open-source vulnerability scanner for containers, filesystems, IaC, and code repositories commonly integrated into CI/CD pipelines.
Question 4: What is the key difference between Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST)?
- SAST scans running applications while DAST analyzes source code at rest
- SAST analyzes source code without executing it while DAST tests running applications (Correct answer)
- SAST is used in production environments while DAST is restricted to development
- SAST requires network access to function while DAST analyzes compiled binaries offline
Correct answer: SAST analyzes source code without executing it while DAST tests running applications
SAST analyzes source code, bytecode, or binaries without executing the application (white-box), while DAST tests the application in its running state from the outside (black-box).
Question 5: What is the National Vulnerability Database (NVD) primarily used for in vulnerability management?
- Storing an organization's internal vulnerability scan results
- Managing internal penetration testing reports and findings
- Enriching CVE records with CVSS severity scores and additional metadata (Correct answer)
- Tracking zero-day vulnerabilities before their public disclosure
Correct answer: Enriching CVE records with CVSS severity scores and additional metadata
The NVD is a U.S. government repository managed by NIST that enriches CVE data with CVSS scores, CWE classifications, CPE applicability statements, and remediation guidance.
Question 6: A CVSS v3 base score of 9.8 would be categorized under which severity level?
- High
- Medium
- Critical (Correct answer)
- Extreme
Correct answer: Critical
In CVSS v3, scores between 9.0 and 10.0 are classified as Critical severity, requiring immediate remediation due to the potential for widespread, severe impact.
Question 7: What is a zero-day vulnerability?
- A vulnerability that was patched on the same day it was discovered by the vendor
- A vulnerability with a CVSS base score of exactly 0.0
- A vulnerability that is unknown to the software vendor and has no available patch (Correct answer)
- A vulnerability that only affects newly deployed systems in the first 24 hours
Correct answer: A vulnerability that is unknown to the software vendor and has no available patch
A zero-day vulnerability is a security flaw unknown to the vendor, giving them zero days to prepare a fix before it can be exploited by attackers.
CDP Threat Modeling & Vulnerability Management 2
What is the scoring range for CVSS (Common Vulnerability Scoring System) base scores?