Vulnerability Prioritization CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which CVSS metric group captures the impact of a vulnerability on the confidentiality, integrity, and availability of a system?

   • AScope metrics
   • BImpact metrics
   • CTemporal metrics
   • DExploitability metrics
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is asset value an important consideration when prioritizing vulnerabilities?

   • ABecause vulnerabilities on high-value assets should be prioritized to protect critical business functions.
   • BBecause asset value is the only factor that should be used in prioritization.
   • CBecause low-value assets do not need to be patched.
   • DBecause asset value determines the CVSS score of a vulnerability.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is assessing a vulnerability in a custom web application. The vulnerability requires the attacker to be on the same network segment and to have valid credentials for a low-privileged account. There is no known exploit available. The application processes non-sensitive internal data. What is the MOST appropriate prioritization for this vulnerability?

   • ALow priority, because the exploitability requirements are high and the impact is limited
   • BMedium priority, because the vulnerability is in a web application
   • CHigh priority, because any vulnerability in a web application is critical
   • DImmediate priority, because there is no known exploit and it could be discovered later
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A vulnerability scanner reports a vulnerability with a CVSS vector string: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is found on a database server that is only accessible from the internal network. The analyst is preparing a report for management. What is the MOST accurate interpretation of this vector?

   • AThe vulnerability requires local access and high privileges to exploit
   • BThe vulnerability can only be exploited by an authenticated user on the same network
   • CThe vulnerability can be exploited remotely without authentication, but the impact is limited to the database server only
   • DThe vulnerability has a low impact on confidentiality, integrity, and availability
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to validate vulnerability findings in the context of the organization's environment?

   • ATo ensure the vulnerability is not a false positive and is relevant to the organization's systems and configurations.
   • BTo comply with regulatory requirements that mandate validation for all findings.
   • CTo increase the CVSS score of the vulnerability for reporting purposes.
   • DTo automatically remediate the vulnerability without human intervention.
   Reveal Solution Discussion Select an answer first