Threat Intelligence and Vulnerability Management Flashcards

Which framework categorizes threat actors and their motivations into APT groups with numbered designations?

Answer: MITRE ATT&CK with Group designations (e.g., APT28)

MITRE ATT&CK catalogs threat actor groups (e.g., APT28, Lazarus Group) with their known TTPs, enabling defenders to tailor controls.

What is a threat feed and how is it used in network defense?

Answer: A continuously updated list of IoCs that is integrated into security tools to block or detect known threats

Threat feeds provide real-time IoCs (IPs, domains, hashes) that are ingested by firewalls, SIEM, and IDS to automate detection of known bad actors.

Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?

Answer: Risk-based patch prioritization

Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.

What is the difference between a CVE and a CWE?

Answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

A CNDA is evaluating whether to prioritize patching based on CVSS base score alone. What is the limitation of this approach?

Answer: CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls

CVSS base scores measure severity in isolation — they do not reflect whether a vulnerability is actively exploited or whether mitigating controls reduce actual risk.

What is a bug bounty program in the context of vulnerability management?

Answer: A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment

Bug bounty programs create a structured channel for external security researchers to report vulnerabilities responsibly before malicious actors find them.