CND Threat Assessment & Vulnerability Management 2 — Questions and Answers
Question 1: Which vulnerability scoring system provides a standardized method for rating the severity of security vulnerabilities?
- CVSS (Correct answer)
- STRIDE
- DREAD
- PASTA
Correct answer: CVSS
The Common Vulnerability Scoring System (CVSS) is an open framework that provides a standardized way to communicate the characteristics and severity of software vulnerabilities.
Question 2: A penetration tester discovers that an organization's web application allows SQL injection. In the threat modeling context, what does this represent?
- A threat
- A vulnerability (Correct answer)
- A risk
- An exploit
Correct answer: A vulnerability
SQL injection is a vulnerability — a weakness in the system that can be exploited; the actual attack attempt would be the threat.
Question 3: During a vulnerability assessment, a scanner reports a finding with a CVSS Base Score of 9.8. How should this be prioritized?
- Low priority — address in next maintenance window
- Medium priority — schedule within 90 days
- Critical priority — remediate immediately (Correct answer)
- Informational — monitor only
Correct answer: Critical priority — remediate immediately
A CVSS score of 9.8 falls in the Critical range (9.0–10.0), requiring immediate remediation due to the high likelihood of exploitation and potential impact.
Question 4: What is the primary difference between a vulnerability scan and a penetration test?
- Vulnerability scans require physical access; pen tests do not
- Vulnerability scans identify weaknesses automatically; pen tests actively exploit them to confirm impact (Correct answer)
- Penetration tests are automated; vulnerability scans are manual
- Vulnerability scans are illegal without written consent; pen tests are not
Correct answer: Vulnerability scans identify weaknesses automatically; pen tests actively exploit them to confirm impact
Vulnerability scans discover and report potential weaknesses, while penetration tests go further by actively exploiting those weaknesses to demonstrate real-world impact.
Question 5: An organization uses threat intelligence feeds to identify indicators of compromise (IoCs). Which of the following is an example of an IoC?
- A weak password policy
- An unpatched operating system
- A known malicious IP address communicating with internal hosts (Correct answer)
- An open port on a firewall
Correct answer: A known malicious IP address communicating with internal hosts
Indicators of compromise (IoCs) are artifacts such as malicious IP addresses, domain names, or file hashes that indicate a system has been breached or is under attack.
Question 6: Which phase of the vulnerability management lifecycle involves applying patches, reconfiguring systems, or implementing compensating controls?
- Discovery
- Prioritization
- Remediation (Correct answer)
- Verification
Correct answer: Remediation
The remediation phase is where identified vulnerabilities are addressed by patching, reconfiguring, or applying compensating controls to reduce risk.
Question 7: What does the term 'attack surface' refer to in threat assessment?
- The geographic area from which attacks originate
- The total set of different points where an attacker could enter or extract data from an environment (Correct answer)
- The number of active exploits targeting a system
- The time window during which a system is vulnerable
Correct answer: The total set of different points where an attacker could enter or extract data from an environment
The attack surface encompasses all the different points (network interfaces, APIs, user inputs, etc.) where an unauthorized user could attempt to enter or extract data.
CND Threat Assessment & Vulnerability Management 2
Which vulnerability scoring system provides a standardized method for rating the severity of security vulnerabilities?