CDP Threat Modeling & Vulnerability Management 2

Question 1

What is the scoring range for CVSS (Common Vulnerability Scoring System) base scores?

Accepted Answer

0.0 to 10.0

Answer

1 to 100

Answer

1 to 10

Answer

0 to 5

Question 2

What does CVE stand for in the context of vulnerability management?

Accepted Answer

Common Vulnerabilities and Exposures

Answer

Common Vulnerability Enumeration

Answer

Critical Vulnerability Exposure

Answer

Centralized Vulnerability Engine

Question 3

Which open-source tool is widely used in DevSecOps pipelines to scan container images for known vulnerabilities?

Accepted Answer

Trivy

Answer

SonarQube

Answer

Burp Suite

Answer

Metasploit

Question 4

What is the key difference between Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST)?

Accepted Answer

SAST analyzes source code without executing it while DAST tests running applications

Answer

SAST scans running applications while DAST analyzes source code at rest

Answer

SAST is used in production environments while DAST is restricted to development

Answer

SAST requires network access to function while DAST analyzes compiled binaries offline

Question 5

What is the National Vulnerability Database (NVD) primarily used for in vulnerability management?

Accepted Answer

Enriching CVE records with CVSS severity scores and additional metadata

Answer

Storing an organization's internal vulnerability scan results

Answer

Managing internal penetration testing reports and findings

Answer

Tracking zero-day vulnerabilities before their public disclosure

Question 6

A CVSS v3 base score of 9.8 would be categorized under which severity level?

Accepted Answer

Critical

Answer

High

Answer

Medium

Answer

Extreme

Question 7

What is a zero-day vulnerability?

Accepted Answer

A vulnerability that is unknown to the software vendor and has no available patch

Answer

A vulnerability that was patched on the same day it was discovered by the vendor

Answer

A vulnerability with a CVSS base score of exactly 0.0

Answer

A vulnerability that only affects newly deployed systems in the first 24 hours