CNDA Threat Intelligence and Vulnerability Management 2 — Questions and Answers
Question 1: Which framework categorizes threat actors and their motivations into APT groups with numbered designations?
- NIST CSF
- MITRE ATT&CK with Group designations (e.g., APT28) (Correct answer)
- OWASP Top 10
- CVE numbering system
Correct answer: MITRE ATT&CK with Group designations (e.g., APT28)
MITRE ATT&CK catalogs threat actor groups (e.g., APT28, Lazarus Group) with their known TTPs, enabling defenders to tailor controls.
Question 2: What is a threat feed and how is it used in network defense?
- A news service about cybersecurity incidents
- A continuously updated list of IoCs that is integrated into security tools to block or detect known threats (Correct answer)
- A management dashboard for security teams
- A log aggregation service
Correct answer: A continuously updated list of IoCs that is integrated into security tools to block or detect known threats
Threat feeds provide real-time IoCs (IPs, domains, hashes) that are ingested by firewalls, SIEM, and IDS to automate detection of known bad actors.
Question 3: Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?
- Risk-based patch prioritization (Correct answer)
- Universal patching
- Compensating controls only
- Patch deferral
Correct answer: Risk-based patch prioritization
Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.
Question 4: What is the difference between a CVE and a CWE?
- CVE is for networks; CWE is for applications
- CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
- CVE scores severity; CWE tracks patches
- They are identical naming conventions
Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses
CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.
Question 5: A CNDA is evaluating whether to prioritize patching based on CVSS base score alone. What is the limitation of this approach?
- CVSS base scores are not publicly available
- CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls (Correct answer)
- CVSS scores only apply to web vulnerabilities
- CVSS scores change daily
Correct answer: CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls
CVSS base scores measure severity in isolation — they do not reflect whether a vulnerability is actively exploited or whether mitigating controls reduce actual risk.
Question 6: What is a bug bounty program in the context of vulnerability management?
- An internal reward for security team members who find bugs
- A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment (Correct answer)
- A government grant for cybersecurity research
- A tool that automatically discovers and reports bugs
Correct answer: A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment
Bug bounty programs create a structured channel for external security researchers to report vulnerabilities responsibly before malicious actors find them.
CNDA Threat Intelligence and Vulnerability Management 2
Which framework categorizes threat actors and their motivations into APT groups with numbered designations?