Vulnerability Analysis and CVSS CEH Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A security analyst is writing a report and needs to reference a vulnerability by its standardized identifier and include its severity rating. Which pair of resources should the analyst use?

   • ACVE for the identifier and NVD for the CVSS score
   • BNVD for the identifier and CVE for the CVSS score
   • CNVD for both the identifier and the CVSS score
   • DCVE for both the identifier and the CVSS score
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A vulnerability scanner reports a flaw with the following CVSS v3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N. A security analyst needs to explain the attack characteristics to a non-technical manager. Which description accurately reflects the vector?

   • AThe attack requires adjacent network access and low privileges, with high impact to all security objectives
   • BThe attacker must have local access, high privileges, and the victim must interact, but the impact is limited to low confidentiality and integrity loss
   • CThe vulnerability affects only the availability of the system, with no impact on confidentiality or integrity
   • DThe attacker can exploit the vulnerability remotely without any privileges or user interaction
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is evaluating a vulnerability in a custom web application. The CVSS base score is 7.5 (High). The application is only accessible from the internal network, and the vulnerability requires authentication. The team has confirmed that a workaround exists that mitigates the vulnerability without a full patch. The vendor has released a patch, but it requires a maintenance window that would cause significant downtime. The team must decide whether to apply the patch immediately or wait. Which approach best incorporates CVSS temporal and environmental metrics into the decision?

   • AIgnore the CVSS score and make the decision based solely on the availability of the workaround
   • BApply the patch only if the workaround is not effective, otherwise wait for the next scheduled maintenance
   • CApply the patch immediately because the base score is High and any delay increases risk
   • DDelay the patch and apply the workaround, because the environmental and temporal metrics likely reduce the effective severity
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which vulnerability category would include an unpatched operating system service that is exposed to the internet?

   • ANetwork vulnerability
   • BHost vulnerability
   • CPhysical vulnerability
   • DApplication vulnerability
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is prioritizing vulnerabilities found during an internal network scan. The organization has a public-facing web server, an internal file server, and a database server. The analyst has the following CVSS v3.1 base scores: Web server: 9.1, File server: 7.5, Database server: 6.5. The analyst also knows that the web server is directly accessible from the internet, while the file and database servers are only reachable from the internal network. What should the analyst do first?

   • APatch all three simultaneously because CVSS scores do not account for exposure
   • BPatch the database server first because it contains sensitive data
   • CPatch the file server first because it is internal and more likely to be exploited by insiders
   • DPatch the web server vulnerability first because it has the highest CVSS score and is internet-facing
   Reveal Solution Discussion Select an answer first