Interpreting Advisory Notices and CVE ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   A cybersecurity analyst is reviewing an advisory for a gas pipeline SCADA system. The advisory includes a 'Severity' section that states 'High' and a 'Remediation' section that says 'Upgrade to version 2.1.0 or later.' The analyst's system is running version 2.0.5. What should the analyst do?

   • APlan to upgrade the system to version 2.1.0 or later
   • BDowngrade to an earlier version to avoid the vulnerability
   • CIgnore the advisory because the severity is only 'High'
   • DApply a workaround from the advisory if one is listed
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When correlating an advisory notice to CVE entries, what is the primary purpose of the CVE references listed in the advisory?

   • ATo provide the CVSS score
   • BTo provide the patch download link
   • CTo provide the vendor's contact information
   • DTo provide a direct link to the detailed vulnerability records
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A power distribution company receives an advisory for a vulnerability in their substation gateway. The advisory lists a firmware update, but the update requires a maintenance window that would interrupt power monitoring for 30 minutes. The advisory also lists a workaround that involves restricting network access to the gateway via firewall rules. The company cannot schedule the maintenance window for two weeks. What should the company do immediately?

   • AIgnore the advisory because the workaround is not a permanent fix.
   • BApply the firmware update immediately, even if it interrupts monitoring, because the vulnerability is critical.
   • CApply the workaround (firewall restriction) immediately and schedule the firmware update for the next available maintenance window.
   • DWait for the maintenance window and apply the firmware update without the workaround.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A water utility's engineering team receives a vendor advisory for their SCADA HMI software. The advisory lists affected product versions, a CVSS score of 9.8, and a 'Workaround' section that describes disabling a specific DCOM interface. The team needs to protect the system immediately while the vendor develops a patch. What should the team do first?

   • ADisconnect the HMI servers from the network permanently
   • BWait for the vendor to release a patch before taking any action
   • CReplace all HMI servers with a different vendor's product
   • DApply the workaround described in the advisory to all affected HMI servers
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A vendor advisory for a remote access gateway used in an oil refinery lists two CVEs: CVE-2024-3001 and CVE-2024-3002. The advisory's remediation section states that firmware version 2.0 resolves CVE-2024-3001, but does not mention CVE-2024-3002. The refinery is running firmware 1.9. The CVE record for CVE-2024-3002 lists a patch in firmware 2.1. The refinery's change management policy requires that any firmware update be tested for at least two weeks before deployment. What should the refinery do?

   • APlan to upgrade to firmware 2.1, which addresses both CVEs, and begin the two-week testing process immediately.
   • BUpgrade to firmware 2.0 immediately and then upgrade to 2.1 after testing, but do not test 2.1 because it is a minor update.
   • CUpgrade to firmware 2.0 immediately because it resolves CVE-2024-3001, and ignore CVE-2024-3002.
   • DStay on firmware 1.9 and apply network workarounds for both CVEs until a tested update is available.
   Reveal Solution Discussion Select an answer first