CND Threat Assessment & Vulnerability Management 4

Question 1

Which concept describes a vulnerability that is being actively exploited by attackers before the vendor is aware of it or has issued a patch?

Accepted Answer

Zero-day vulnerability

Answer

A zero-day vulnerability is one that is unknown to the software vendor and is actively exploited before a patch or mitigation is available.

Question 2

In the context of threat assessment, what does 'threat likelihood' measure?

Accepted Answer

The probability that a specific threat will exploit a given vulnerability

Answer

Threat likelihood (or probability) estimates how likely it is that a particular threat will successfully exploit a vulnerability within a given timeframe.

Question 3

A network defender reviews scan results and must decide which vulnerabilities to fix first. Which framework helps prioritize based on whether a vulnerability is actively being exploited in the wild?

Accepted Answer

EPSS (Exploit Prediction Scoring System)

Answer

EPSS predicts the likelihood that a vulnerability will be exploited in the wild within 30 days, helping prioritize remediation beyond static CVSS scores alone.

Question 4

What is the role of a CVE (Common Vulnerabilities and Exposures) identifier in vulnerability management?

Accepted Answer

It provides a unique, standardized reference number for publicly known vulnerabilities

Answer

CVE identifiers provide a unique, standardized naming convention for publicly known vulnerabilities, enabling consistent communication across tools and organizations.

Question 5

During threat assessment, the security team applies the 'threat × vulnerability × impact' formula. What does this calculation produce?

Accepted Answer

A risk rating for the identified threat scenario

Answer

Multiplying threat likelihood by vulnerability severity by potential impact produces a risk rating that helps prioritize which issues require the most urgent attention.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Threat Assessment & Vulnerability Management 4