Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In CVSS base metrics, what does the Scope (S) metric indicate?

   • AThe level of user interaction required
   • BWhether a vulnerability in one component can impact resources beyond its security authority
   • CThe physical area where the vulnerability can be exploited
   • DThe number of systems that can be attacked
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security engineer needs to verify that all Windows-based engineering workstations in a manufacturing plant have a specific registry key set to a secure value. The engineer wants to use a standardized, machine-readable format that can be shared across different vulnerability scanners and configuration assessment tools. Which approach should the engineer use?

   • ACreate an OVAL definition with a registry test that checks the key's value, then run it with any OVAL-compliant scanner.
   • BUse a CVSS vector string to describe the registry key configuration.
   • CWrite a custom PowerShell script and distribute it to each workstation for manual execution.
   • DManually check each workstation using the registry editor and record the results in a spreadsheet.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst at a chemical plant receives an OVAL-based scan report showing that a specific DLL on several HMI workstations is outdated and vulnerable. The analyst also has a CVSS base score of 9.0 for the vulnerability. However, the HMI workstations are on a segmented network with strict egress filtering, and the vulnerability requires local access to exploit. What should the analyst do before scheduling a patch window?

   • AAdjust the CVSS score using environmental metrics to reflect the local access requirement and network segmentation, then re-prioritize.
   • BImmediately patch all affected HMI workstations because the CVSS score is critical and the OVAL scan confirmed the vulnerability.
   • CRequest a new OVAL definition from the vendor because the scan result must be incorrect if the CVSS score is 9.0.
   • DIgnore the OVAL result because the CVSS score is not high enough to warrant action in an ICS environment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can an organization combine CVSS scores with OVAL-based assessment results to prioritize vulnerabilities in an ICS/SCADA environment?

   • AUse OVAL to confirm the presence of the vulnerability and CVSS to assess its severity, then prioritize based on both the score and the criticality of the affected asset
   • BUse CVSS to replace OVAL in vulnerability scanning
   • CUse CVSS to identify which systems are vulnerable and OVAL to calculate the score
   • DUse OVAL to patch vulnerabilities and CVSS to verify the patch
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is comparing two CVSS vectors for vulnerabilities in a wastewater treatment plant. Vulnerability 1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vulnerability 2: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L. Which statement correctly compares the two vulnerabilities?

   • AVulnerability 2 is more severe because it requires user interaction, which indicates a more complex attack.
   • BVulnerability 1 is more severe because it has a network attack vector, low complexity, no privileges required, and high impact on all security objectives.
   • CBoth are equally severe because they both have a scope component.
   • DVulnerability 2 is more severe because it has a changed scope, which always increases the score more than any other factor.
   Reveal Solution Discussion Select an answer first