Interpreting Advisory Notices and CVE ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vendor advisory for a distributed control system (DCS) lists multiple CVEs, including CVE-2024-1111 and CVE-2024-1112. The advisory states that CVE-2024-1111 is resolved by patch A, and CVE-2024-1112 is resolved by patch B. The system administrator has only enough downtime to apply one patch this week. What should the administrator do?

   • AApply patch A first because it is listed first in the advisory
   • BApply the patch that addresses the CVE with the higher CVSS score
   • CWait until both patches can be applied together
   • DApply patch B first because it is the second CVE
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A CVE record for a human-machine interface (HMI) application includes the following description: 'The application does not properly validate input in the tag name field, allowing a remote authenticated user to inject commands.' The references include a vendor security bulletin and a patch link. An engineer wants to know if the vulnerability can be exploited by an unauthenticated attacker. What should the engineer do?

   • AAssume the vulnerability is exploitable by unauthenticated attackers because the CVSS score is high.
   • BRead the CVE description carefully; it states that the attacker must be authenticated, so unauthenticated exploitation is not possible.
   • CContact the vendor to ask if the authentication requirement is a typo.
   • DCheck the patch link to see if it removes the authentication requirement.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A manufacturing plant has a legacy SCADA system that is no longer supported by the vendor. A new advisory is published for a similar product line, and the plant's system is not listed in the affected products. However, the plant's system uses the same vulnerable component. The plant cannot upgrade due to cost. What should the plant do?

   • AApply the patch from the advisory to the legacy system
   • BUpgrade the system despite the cost
   • CIgnore the advisory because the system is not listed
   • DImplement compensating controls, such as network segmentation and monitoring, to reduce the risk
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a CVSS vector string, which metric group reflects the characteristics of the vulnerability that are constant over time and across user environments?

   • AThreat metrics
   • BBase metrics
   • CTemporal metrics
   • DEnvironmental metrics
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary role of a CVE identifier in vulnerability management for ICS/SCADA systems?

   • ATo list all affected products
   • BTo provide a patch for the vulnerability
   • CTo assign a severity score to a vulnerability
   • DTo provide a unique, standardized identifier for a specific vulnerability
   Reveal Solution Discussion Select an answer first