Analyzing Vulnerabilities -- Quiz

Question 1 of 6

A vulnerability scanner reports that a server is running a version of OpenSSL with a known buffer overflow vulnerability. The security analyst investigates and discovers that the vendor released a hotfix three weeks ago that patched the code path without changing the version number. The scanner cannot detect the hotfix. This finding is best classified as:

A real vulnerability that should be patched immediately regardless of the hotfix A false positive, because the system is not actually vulnerable A false negative, because the scanner failed to detect the vulnerability A low-severity finding that should remain in the tracking system

Question 2 of 6

A healthcare organization ran its weekly vulnerability scan on Monday. On Wednesday, a critical zero-day was publicly disclosed with active exploitation confirmed. The organization reviews Monday's scan report, finds no mention of the new vulnerability, and concludes no systems are affected. What type of scan error is most likely, and what should the team do next?

False positive; close the finding and rescan next week False positive; tune the scanner before the next scheduled scan False negative; update signatures and rescan immediately True negative; Monday's clean report confirms the environment is secure

Question 3 of 6

An analyst receives two scan reports for the same CVE: one tool reports a CVSS score of 6.5 and another reports 9.1. When the analyst checks the NVD, she finds the CVE has a CVSS 2.0 score of 6.5 and a CVSS 3.x score of 9.1. Which score should drive remediation priority, and why?

6.5, because it comes from the more established CVSS 2.0 framework Average the two scores (7.8) to get a balanced assessment Discard both and manually calculate a score using the NVD calculator 9.1, because CVSS 3.x is the current standard and uses a more complete methodology

Question 4 of 6

A utility company discovers a vulnerability in its power distribution monitoring system. The same CVE affects a comparable software installation at a retail company. The utility rates the finding as Critical and plans to patch within 24 hours; the retail company rates it High and plans to patch within 7 days. Which of the following best explains this difference?

The utility's scanner is using a newer signature database with a higher CVSS score The organizational type and operational impact differ; critical infrastructure faces greater consequences from exploitation The retail company has a higher risk tolerance by policy and should be penalized for it The utility is overreacting; the CVSS score is the same for both organizations

Question 5 of 6

An asset with a value of $400,000 hosts a service with a vulnerability that could completely disable it if exploited. What is the Single Loss Expectancy (SLE) for this vulnerability?

$200,000 (50% exposure factor assumed) $40,000 (10% exposure factor assumed) $400,000 (100% exposure factor because complete service loss is possible) Cannot be calculated without knowing the annual rate of occurrence

Question 6 of 6

A patch is released for a Critical (CVSS 9.8) vulnerability in an internet-facing web application. Within hours, threat intelligence confirms active exploitation. The organization's standard patch policy requires 72 hours of testing. What does appropriate risk tolerance suggest in this scenario?

Follow standard policy; the 72-hour test cycle protects against operational risk from untested patches Compress the testing cycle to hours rather than days; the exposure window on an internet-facing CVSS 9.8 with active exploitation outweighs the operational risk of accelerated testing Wait for the vendor to release a second patch that confirms the first is stable Disable the internet-facing service entirely and wait 72 hours for testing

Matching

Match each description to the correct term.

1. Scanner reports a vulnerability that does not actually exist on the system

2. A real vulnerability exists on the system but does not appear in the scan report

3. Percentage of asset value or service capacity potentially lost if a vulnerability is exploited

4. The level of risk an organization accepts during the window between vulnerability discovery and completed remediation

1. 2. 3. 4.

A. False positive

B. False negative

C. Exposure factor

D. Risk tolerance

Analyzing Vulnerabilities — Quiz

Matching