NSE Threat Analysis & Vulnerability Management 2 — Questions and Answers
Question 1: Which CVSS v3 metric indicates whether a vulnerability can be exploited without any authentication?
- Privileges Required: None (Correct answer)
- User Interaction: None
- Attack Vector: Network
- Scope: Changed
Correct answer: Privileges Required: None
The Privileges Required metric set to None means the attacker requires no authentication to exploit the vulnerability.
Question 2: In threat intelligence, what does the term 'TTP' stand for?
- Threat, Tactics, Persistence
- Tactics, Techniques, and Procedures (Correct answer)
- Trusted Threat Platform
- Targeted Threat Profile
Correct answer: Tactics, Techniques, and Procedures
TTPs describe how threat actors operate, covering their Tactics (goals), Techniques (methods), and Procedures (specific implementations).
Question 3: A security team discovers a publicly disclosed vulnerability with no vendor patch available. This is best described as a:
- Zero-day vulnerability (Correct answer)
- Known exploited vulnerability
- Residual risk
- Latent threat
Correct answer: Zero-day vulnerability
A zero-day is a vulnerability that is publicly known (or actively exploited) but has no official vendor patch available.
Question 4: Which threat modeling methodology uses the acronym STRIDE to categorize threats?
- PASTA
- DREAD
- Microsoft Threat Modeling (Correct answer)
- OCTAVE
Correct answer: Microsoft Threat Modeling
Microsoft's Threat Modeling methodology introduced STRIDE, which categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Question 5: What is the primary purpose of a vulnerability scanner in an NSE environment?
- Block active exploits in real time
- Identify and report known weaknesses in systems and applications (Correct answer)
- Decrypt encrypted malware payloads
- Replace the need for penetration testing
Correct answer: Identify and report known weaknesses in systems and applications
Vulnerability scanners enumerate hosts and compare their configurations and software versions against known vulnerability databases to report weaknesses.
Question 6: An analyst receives an IOC feed containing file hashes. Which attack phase do file hash indicators most directly relate to?
- Initial reconnaissance
- Delivery and execution (Correct answer)
- Command and control
- Lateral movement
Correct answer: Delivery and execution
File hashes are used to identify malicious files delivered to a target, directly mapping to the delivery and execution phase of the kill chain.
Question 7: FortiGuard's threat intelligence service provides which type of data to FortiGate firewalls?
- User behavior analytics baselines
- Malicious IP/domain reputation, IPS signatures, and antivirus updates (Correct answer)
- SSL certificate revocation lists only
- SIEM correlation rules
Correct answer: Malicious IP/domain reputation, IPS signatures, and antivirus updates
FortiGuard delivers continuously updated threat intelligence including IP/domain reputation, IPS signatures, antivirus definitions, and web filtering categories to FortiGate devices.
NSE Threat Analysis & Vulnerability Management 2
Which CVSS v3 metric indicates whether a vulnerability can be exploited without any authentication?