Vulnerability Analysis and CVSS CEH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is preparing a remediation plan for a client. The client has a public-facing web server with a critical vulnerability (CVSS 9.8) that is actively being exploited in the wild. The client also has an internal database server with a high vulnerability (CVSS 8.1) that is not exposed to the internet. The client has limited staff and can only patch one system this week. Which vulnerability should be patched first?

   • ABoth vulnerabilities, because they are both high or critical severity
   • BThe web server vulnerability, because it is critical, internet-facing, and actively exploited
   • CThe database server vulnerability, because internal threats are more common
   • DThe database server vulnerability, because it contains sensitive data
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A penetration tester has identified two vulnerabilities in a client's environment. Vulnerability A has a CVSS base score of 9.0 but is only exploitable by an attacker with physical access to the server room. Vulnerability B has a CVSS base score of 6.5 but is remotely exploitable without authentication and affects an internet-facing application. The client has limited resources and can only remediate one vulnerability this week. Which vulnerability should be prioritized?

   • AVulnerability A, because physical access vulnerabilities are harder to detect and therefore more dangerous
   • BVulnerability A, because the CVSS score is higher and the impact is likely more severe
   • CBoth vulnerabilities equally, because CVSS scores are the only objective measure of risk
   • DVulnerability B, because the remote, unauthenticated exploitation of an internet-facing application poses a greater immediate risk
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating a vulnerability that was disclosed in a third-party library used by the company's application. The analyst needs to find out if the vulnerability has a CVE ID, what the CVSS score is, and whether there are any known exploits. Which combination of resources should the analyst use?

   • AThe vendor's patch notes only, because they include the CVE ID and CVSS score
   • BA search engine for the library name and 'vulnerability'
   • CNVD for CVE ID and CVSS score, and the vendor's advisory for exploit information
   • DThe CVE list only, because it contains all necessary information
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team has a limited maintenance window and must choose between patching a critical vulnerability (CVSS 9.8) on a non-critical internal server and patching a high vulnerability (CVSS 7.5) on an internet-facing web server. The exploit for the critical vulnerability is not public, while the high vulnerability has an active exploit in the wild. Which should the team patch first?

   • AThe high vulnerability, because it is internet-facing and has an active exploit.
   • BBoth at the same time, because both are above 7.0.
   • CNeither, because the team should wait for the next scheduled patch cycle.
   • DThe critical vulnerability, because the CVSS score is higher.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a remediation context, why is CVSS score alone not sufficient for prioritizing vulnerabilities?

   • ABecause CVSS scores are not standardized across different databases
   • BBecause it does not account for the specific business impact and exploitability in a given environment
   • CBecause CVSS scores are always too high and overstate risk
   • DBecause CVSS scores are only available for vulnerabilities that have been exploited in the wild
   Reveal Solution Discussion Select an answer first