CND Threat Assessment & Vulnerability Management 5 — Questions and Answers
Question 1: Which MITRE framework maps adversary tactics, techniques, and procedures (TTPs) and is widely used to inform threat assessments and detection strategies?
- CVE Database
- MITRE ATT&CK (Correct answer)
- NIST NVD
- CWE List
Correct answer: MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary behaviors organized by tactics and techniques, used to model threats and improve detection and response capabilities.
Question 2: A security analyst uses open-source intelligence (OSINT) gathering as part of threat assessment. Which of the following is an OSINT technique?
- Scanning internal network hosts with Nessus
- Reviewing publicly available social media profiles to identify potential insider threats (Correct answer)
- Running authenticated scans against production servers
- Analyzing core memory dumps from compromised endpoints
Correct answer: Reviewing publicly available social media profiles to identify potential insider threats
OSINT involves collecting information from publicly available sources such as social media, websites, and public records to assess threats without direct system access.
Question 3: What is the purpose of vulnerability verification after a patch has been applied?
- To notify stakeholders that a patch was downloaded
- To confirm the vulnerability no longer exists and the fix was effective (Correct answer)
- To document the vulnerability in the risk register for future reference
- To escalate the issue to senior management
Correct answer: To confirm the vulnerability no longer exists and the fix was effective
Verification rescans the system after remediation to confirm the vulnerability has been successfully resolved and no residual exposure remains.
Question 4: In threat modeling, an 'asset' is best defined as:
- Any software vulnerability that can be exploited by an attacker
- Anything of value to the organization that needs protection (Correct answer)
- A documented list of all known threat actors
- The network perimeter boundary of an organization
Correct answer: Anything of value to the organization that needs protection
Assets are the components of value within an organization — including data, systems, personnel, and processes — that threat modeling seeks to protect.
Question 5: A CND professional is performing a risk assessment and categorizes a threat as having high likelihood but very low impact. How should this be treated compared to a low-likelihood, high-impact threat?
- Both are identical risks and should receive equal priority
- The high-likelihood/low-impact threat should always be remediated first
- Risk ratings depend on combined likelihood and impact; they must be compared holistically using a risk matrix (Correct answer)
- The low-likelihood/high-impact threat should always be ignored
Correct answer: Risk ratings depend on combined likelihood and impact; they must be compared holistically using a risk matrix
A risk matrix plots likelihood against impact to produce a combined risk score; neither factor alone determines priority — both must be weighed together.
Question 6: Which vulnerability management metric measures the average time between when a vulnerability is discovered and when it is fully remediated?
- Mean Time to Detect (MTTD)
- Mean Time to Remediate (MTTR) (Correct answer)
- Vulnerability Density Score
- Patch Compliance Rate
Correct answer: Mean Time to Remediate (MTTR)
Mean Time to Remediate (MTTR) tracks how long it takes on average to fix vulnerabilities after discovery, and is a key KPI for vulnerability management program effectiveness.
Question 7: During a threat assessment, a security team identifies that a critical server is running an end-of-life (EoL) operating system. What is the PRIMARY security concern?
- The system will run slower due to outdated hardware drivers
- No further security patches will be released, leaving new vulnerabilities permanently unmitigated (Correct answer)
- The system cannot be scanned by modern vulnerability scanners
- EoL systems automatically expose credentials to the network
Correct answer: No further security patches will be released, leaving new vulnerabilities permanently unmitigated
End-of-life systems no longer receive security patches from the vendor, meaning any newly discovered vulnerabilities will never be officially fixed, creating permanent risk.
CND Threat Assessment & Vulnerability Management 5
Which MITRE framework maps adversary tactics, techniques, and procedures (TTPs) and is widely used to inform threat assessments and detection strategies?