Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   In OVAL, what is the role of an 'object' within a test?

   • AIt specifies the CVSS score
   • BIt contains the vulnerability description
   • CIt identifies the specific system component or file to be examined
   • DIt defines the expected result of the test
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A cybersecurity manager at a nuclear power plant is reviewing a vulnerability report that lists a CVSS v3.1 base score of 7.5 for a flaw in a plant monitoring system. The system is connected to the corporate network but is not directly involved in safety functions. The manager must decide whether to allocate emergency resources to patch this vulnerability this week or defer it to the next scheduled maintenance window. The vendor has released a patch, but it requires a system reboot that will cause a brief loss of monitoring. What should the manager do?

   • APatch immediately because the base score is 7.5, which is high, and any delay increases the risk of exploitation.
   • BDefer the patch indefinitely because the system is not involved in safety functions, so the vulnerability is not important.
   • CPatch immediately because the system is connected to the corporate network, making it highly exposed.
   • DDefer the patch to the next maintenance window because the system is not safety-critical and the reboot will cause a brief loss of monitoring.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A large electric utility has deployed OVAL-based scanning across its OT environment. The scan identifies a critical vulnerability (CVSS 9.8) in a legacy remote terminal unit (RTU) that is still in production and cannot be patched because the vendor no longer supports it. The RTU is connected to a network segment that also carries non-critical monitoring traffic. The security team must decide how to mitigate the risk. Which approach is the most appropriate?

   • AApply a virtual patch or intrusion prevention system (IPS) rule to block known exploit patterns, while planning for RTU replacement.
   • BLeave the RTU as is because it is on a segment with only non-critical traffic, so the risk is acceptable.
   • CImmediately isolate the RTU from the network and accept the loss of monitoring capability until a replacement can be procured.
   • DDisconnect the RTU from the network and stop using it, since it is unsupported and vulnerable.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a benefit of using OVAL in a multi-vendor ICS/SCADA environment?

   • AIt provides a single CVSS score for all vulnerabilities
   • BIt eliminates the need for vulnerability scanning altogether
   • CIt allows different security tools to use the same vulnerability definitions, reducing duplication of effort
   • DIt guarantees that all vulnerabilities will be automatically patched
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   According to CVSS v3.x qualitative severity ratings, which score range corresponds to 'High' severity?

   • A4.0 – 6.9
   • B9.0 – 10.0
   • C0.1 – 3.9
   • D7.0 – 8.9
   Reveal Solution Discussion Select an answer first