CREST Security & Vulnerability Management 2 — Questions and Answers
Question 1: Which CVSS v3.1 metric reflects whether an attacker needs privileges before exploiting a vulnerability?
- Attack Vector
- Privileges Required (Correct answer)
- User Interaction
- Scope
Correct answer: Privileges Required
Privileges Required (PR) captures the level of access an attacker must possess prior to successfully exploiting the vulnerability.
Question 2: A vulnerability is discovered in a third-party library bundled with an internal application. What is the FIRST step in the remediation workflow?
- Patch the library immediately in production
- Identify all applications that include the affected library version (Correct answer)
- Notify the vendor and await an official patch
- Disable the application until the vendor responds
Correct answer: Identify all applications that include the affected library version
Before any remediation action, the scope of impact must be established by inventorying all systems that contain the vulnerable component.
Question 3: In the context of vulnerability management, what does 'compensating control' mean?
- A patch applied as a temporary fix
- A security measure that mitigates risk when a direct fix is not feasible (Correct answer)
- An insurance policy covering breach costs
- A redundant firewall rule
Correct answer: A security measure that mitigates risk when a direct fix is not feasible
A compensating control reduces the likelihood or impact of exploitation when the standard remediation (e.g., patching) cannot be applied immediately.
Question 4: Which standard provides a common language for describing security vulnerabilities and exposures?
- OWASP Top 10
- CVE (Common Vulnerabilities and Exposures) (Correct answer)
- ISO 27001
- NIST SP 800-53
Correct answer: CVE (Common Vulnerabilities and Exposures)
CVE is a dictionary of publicly known cybersecurity vulnerabilities maintained by MITRE, providing unique identifiers for each entry.
Question 5: A penetration tester identifies a vulnerability rated CVSS 9.8 on a system that is not internet-facing and has network-level controls limiting access. Which factor most justifies lowering remediation priority?
- The vendor has not issued a patch
- Environmental and network mitigating controls reduce practical exploitability (Correct answer)
- The CVSS base score is provisional
- The system owner disagrees with the finding
Correct answer: Environmental and network mitigating controls reduce practical exploitability
CVSS Environmental metrics allow organizations to adjust scores based on real-world controls, reducing effective risk when compensating mitigations exist.
Question 6: What is the primary goal of attack surface reduction in a vulnerability management program?
- Eliminating all external IP addresses
- Minimizing the number of entry points an attacker can exploit (Correct answer)
- Replacing all legacy systems with cloud services
- Encrypting all data in transit
Correct answer: Minimizing the number of entry points an attacker can exploit
Attack surface reduction focuses on disabling unnecessary services, ports, and interfaces to limit the ways an attacker can reach and exploit vulnerabilities.
Question 7: Which document type formally communicates accepted residual risk when a vulnerability will not be remediated within the SLA?
- Vulnerability scan report
- Risk acceptance or exception form (Correct answer)
- Change management request
- Incident response plan
Correct answer: Risk acceptance or exception form
A risk acceptance form documents the business owner's informed decision to accept residual risk, ensuring accountability and audit trail.
CREST Security & Vulnerability Management 2
Which CVSS v3.1 metric reflects whether an attacker needs privileges before exploiting a vulnerability?