CREST Security & Vulnerability Management 2

Question 1

Which CVSS v3.1 metric reflects whether an attacker needs privileges before exploiting a vulnerability?

Accepted Answer

Privileges Required

Answer

Privileges Required (PR) captures the level of access an attacker must possess prior to successfully exploiting the vulnerability.

Question 2

A vulnerability is discovered in a third-party library bundled with an internal application. What is the FIRST step in the remediation workflow?

Accepted Answer

Identify all applications that include the affected library version

Answer

Before any remediation action, the scope of impact must be established by inventorying all systems that contain the vulnerable component.

Question 3

In the context of vulnerability management, what does 'compensating control' mean?

Accepted Answer

A security measure that mitigates risk when a direct fix is not feasible

Answer

A compensating control reduces the likelihood or impact of exploitation when the standard remediation (e.g., patching) cannot be applied immediately.

Question 4

Which standard provides a common language for describing security vulnerabilities and exposures?

Accepted Answer

CVE (Common Vulnerabilities and Exposures)

Answer

CVE is a dictionary of publicly known cybersecurity vulnerabilities maintained by MITRE, providing unique identifiers for each entry.

Question 5

A penetration tester identifies a vulnerability rated CVSS 9.8 on a system that is not internet-facing and has network-level controls limiting access. Which factor most justifies lowering remediation priority?

Accepted Answer

Environmental and network mitigating controls reduce practical exploitability

Answer

CVSS Environmental metrics allow organizations to adjust scores based on real-world controls, reducing effective risk when compensating mitigations exist.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Security & Vulnerability Management 2