Interpreting Advisory Notices and CVE ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which section of an ICS/SCADA advisory notice typically includes the vendor-specific product names and version numbers that are affected by the vulnerability?

   • ASeverity
   • BAffected Products
   • COverview
   • DRemediation
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When an ICS/SCADA security advisory is published, which of the following is a standard section that provides the specific actions the user should take to address the vulnerability?

   • ARemediation
   • BAffected Products
   • CSeverity
   • DReferences
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is compiling a vulnerability report for a client's ICS environment. The analyst finds two references to the same vulnerability: one in a vendor advisory and one in a CVE record. The advisory uses 'CVE-2021-5555' and the CVE record uses 'CVE-2021-5555'. The analyst wants to ensure they are the same vulnerability. What should the analyst do?

   • AAssume they are the same because the CVE ID is identical.
   • BCompare the CVE ID, description, and affected products between the advisory and the CVE record to confirm they match.
   • CCheck the publication date of the advisory and the CVE record.
   • DUse the CVSS score from the advisory to confirm the CVE record.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a potential vulnerability in a substation automation system. The analyst finds a CVE record that describes a vulnerability in a specific protocol implementation. The CVE record's references include a vendor advisory that lists a different CVE ID for the same issue. What should the analyst do?

   • AIgnore the vendor advisory because it lists a different CVE ID
   • BTreat both CVE IDs as referring to the same vulnerability and use the vendor advisory for remediation details
   • CReport the discrepancy to the CVE program
   • DAssume the vulnerability is not real because of the discrepancy
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security engineer is evaluating two vulnerabilities in a chemical plant's distributed control system (DCS). CVE-2024-2001 has a CVSS base score of 9.8 with a vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CVE-2024-2002 has a base score of 6.5 with a vector AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. The plant's DCS is isolated from the internet but accessible from the corporate network via a firewall that allows only specific IPs. The engineer can only apply one mitigation this month. Which vulnerability should be prioritized?

   • APrioritize both equally because both have high confidentiality impact.
   • BCVE-2024-2002, because it requires only low privileges and has high confidentiality impact.
   • CCVE-2024-2001, because its network attack vector and no-privilege requirement make it more severe, even though the DCS is isolated from the internet.
   • DPrioritize CVE-2024-2002 because it is more likely to be exploited by an insider on the corporate network.
   Reveal Solution Discussion Select an answer first