CNDA Threat Intelligence and Vulnerability Management 2

Question 1

Which framework categorizes threat actors and their motivations into APT groups with numbered designations?

Accepted Answer

MITRE ATT&CK with Group designations (e.g., APT28)

Answer

MITRE ATT&CK catalogs threat actor groups (e.g., APT28, Lazarus Group) with their known TTPs, enabling defenders to tailor controls.

Question 2

What is a threat feed and how is it used in network defense?

Accepted Answer

A continuously updated list of IoCs that is integrated into security tools to block or detect known threats

Answer

Threat feeds provide real-time IoCs (IPs, domains, hashes) that are ingested by firewalls, SIEM, and IDS to automate detection of known bad actors.

Question 3

Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?

Accepted Answer

Risk-based patch prioritization

Answer

Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.

Question 4

What is the difference between a CVE and a CWE?

Accepted Answer

CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

Answer

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

Question 5

A CNDA is evaluating whether to prioritize patching based on CVSS base score alone. What is the limitation of this approach?

Accepted Answer

CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls

Answer

CVSS base scores measure severity in isolation — they do not reflect whether a vulnerability is actively exploited or whether mitigating controls reduce actual risk.

CNDA - Certified Network Defense Architect Practice Test

CNDA - Certified Network Defense Architect Practice Test

CNDA Threat Intelligence and Vulnerability Management 2