Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   An oil refinery's security team is reviewing a list of vulnerabilities found in its OT environment. The team has limited resources and must prioritize remediation. The list includes a CVSS v3.1 base score of 9.8 for a vulnerability in a safety instrumented system (SIS) logic solver, and a CVSS v3.1 base score of 6.5 for a vulnerability in a non-critical data historian. The SIS is air-gapped, while the historian is connected to the corporate network. What is the most important consideration when prioritizing these two findings?

   • AThe historian vulnerability should be prioritized because it is connected to the corporate network, making it more likely to be exploited, despite the lower base score.
   • BThe SIS should be prioritized because it is a safety system, and any vulnerability in a safety system is automatically critical.
   • CThe SIS vulnerability should be prioritized because the base score is higher, regardless of the air gap.
   • DBoth should be treated equally because CVSS scores are the only standardized measure of risk.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security team at a food processing plant has deployed OVAL-based scanning and CVSS scoring across its OT environment. The team has identified a vulnerability with a CVSS base score of 9.0 in a packaging line controller. The controller is on a segmented network with no internet access, and the vendor has confirmed that exploitation requires physical access to the controller. The team must decide how to prioritize this finding against other vulnerabilities with lower base scores but higher exposure. What is the most appropriate approach?

   • APrioritize other vulnerabilities with lower base scores but higher exposure, because the packaging line controller's exploitability is significantly reduced by the physical access requirement and network segmentation.
   • BDefer all findings until the next maintenance window because the base scores are not the only factor, and the team needs more data.
   • CPrioritize the packaging line controller because the base score is 9.0, which is critical, and all critical findings should be addressed first.
   • DTreat the packaging line controller as the highest priority because it is a critical asset, regardless of the exploitability constraints.
   Reveal Solution Discussion Select an answer first
3. 53foundation · easy

   How do environmental metrics in CVSS affect the final score?

   • AThey replace the base score entirely
   • BThey only affect the temporal score
   • CThey adjust the base score based on the organization's specific requirements for confidentiality, integrity, and availability
   • DThey have no effect on the final score
   Reveal Solution Discussion Select an answer first