Interpreting Advisory Notices and CVE ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A pharmaceutical manufacturer uses a legacy SCADA system that is no longer supported by the vendor. A new advisory is published for a vulnerability in the system with a CVSS score of 9.0, but no patch is available. The advisory suggests isolating the system from the corporate network as a mitigation. The plant's network team says full isolation would prevent required remote monitoring. What should the company do?

   • AImplement the isolation mitigation as much as possible, such as restricting access to only the required monitoring IPs, and document the residual risk.
   • BReplace the entire SCADA system immediately to eliminate the vulnerability.
   • CIgnore the advisory because the system is unsupported and no patch exists.
   • DDisconnect the system from the network entirely, even if it stops remote monitoring.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security engineer is reviewing CVE-2022-1234, which describes a buffer overflow in a specific model of a remote terminal unit (RTU). The CVE record's 'affected configurations' field lists firmware versions 1.0 through 1.5. The engineer's RTU runs firmware 1.6. What should the engineer conclude?

   • AThe RTU is affected but the severity is lower
   • BThe RTU is affected because the CVE describes the product family
   • CThe RTU is not affected by this CVE
   • DThe engineer should contact the vendor to confirm
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which CVSS metric group allows an organization to adjust the base score to reflect the importance of the affected asset to their specific environment?

   • ATemporal metrics
   • BEnvironmental metrics
   • CBase metrics
   • DAttack metrics
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A security analyst is documenting a vulnerability found in a building management system. The analyst wants to reference the vulnerability in a report and link to the official CVE record. What should the analyst use?

   • AThe CVE identifier, such as CVE-2023-7890
   • BThe CVSS vector string
   • CThe advisory's publication date
   • DThe vendor's internal bug tracking number
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A municipal water utility receives an advisory for a vulnerability in its SCADA historian with a CVSS base score of 8.1. The advisory provides a patch, but the patch requires a reboot of the historian, which would interrupt data collection for 15 minutes. The utility has a strict service-level agreement (SLA) that requires 99.9% uptime for the historian. The utility's maintenance window is scheduled for next month. The vulnerability is actively being exploited in the wild. What should the utility do?

   • AApply a workaround if one is listed in the advisory, and schedule the patch for the maintenance window.
   • BWait for the scheduled maintenance window to avoid SLA violation.
   • CApply the patch immediately, even if it violates the SLA, because the vulnerability is actively exploited.
   • DIgnore the advisory because the CVSS score is below 9.0.
   Reveal Solution Discussion Select an answer first