Interpreting Advisory Notices and CVE ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst at a manufacturing plant is reviewing a vendor advisory that references 'CVE-2024-1234'. The analyst needs to quickly determine when this vulnerability was publicly assigned and how to look up more details. What does the CVE identifier tell the analyst?

   • AThe vulnerability was assigned in 2024 and the sequence number is 1234, which can be used to search the CVE database for full details.
   • BThe vulnerability has a CVSS score of 12.34 out of 10.
   • CThe vulnerability was patched in 2024 and the patch ID is 1234.
   • DThe vulnerability was discovered in 2024 and affects exactly 1234 products.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is correlating a vendor advisory with a CVE entry. The advisory mentions 'CVE-2023-1234' and provides a link to the CVE record. The analyst wants to confirm that the advisory and the CVE refer to the same vulnerability. What should the analyst do?

   • AAssume they are the same because the advisory mentions the CVE ID
   • BLook for the vendor's name in the CVE record
   • CCheck the CVE's publication date
   • DCompare the affected products and descriptions in the advisory and the CVE record
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security engineer is reviewing a CVSS vector string for a vulnerability in a remote terminal unit (RTU): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The engineer needs to explain the severity to management. Which statement accurately interprets this vector?

   • AThe vulnerability requires physical access to the device and administrative privileges to exploit.
   • BThe vulnerability has low impact on confidentiality but high impact on availability.
   • CThe vulnerability is network-exploitable, requires no privileges or user interaction, and has high impact on confidentiality, integrity, and availability.
   • DThe vulnerability is only exploitable by a user with high privileges and requires user interaction.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A CVE record for a safety instrumented system (SIS) logic solver lists affected configurations as 'Firmware versions 1.0 through 1.5' and describes a vulnerability that allows a remote unauthenticated attacker to cause a denial of service. The CVSS base score is 7.5. The plant's SIS is running firmware 1.6, which is not listed. The vendor has released firmware 1.7 that addresses the CVE. The plant's safety team is concerned about downtime because updating the SIS requires a full process shutdown. What is the best course of action?

   • AAssume firmware 1.6 is vulnerable because it is newer than 1.5 and apply the update as soon as possible.
   • BIgnore the CVE entirely because the plant's version is not affected.
   • CDo not update immediately because firmware 1.6 is not listed as affected, but monitor the vendor for updates and plan a future upgrade.
   • DUpdate to firmware 1.7 immediately, even if it requires a shutdown, because the CVE is critical.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A hospital's building automation system (BAS) is running a version of the controller software that is affected by a critical vulnerability. The vendor's advisory provides a patch, but the hospital's infection control policy requires that any change to the BAS be approved by a committee that meets monthly. The vulnerability is actively being exploited in the wild. What should the facility manager do?

   • AApply the patch immediately and inform the committee at the next meeting
   • BDisconnect the BAS from the network until the committee approves
   • CImplement a workaround if available, and wait for the committee
   • DWait for the committee's approval before applying the patch
   Reveal Solution Discussion Select an answer first