Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A patch management team is prioritizing vulnerabilities in a power utility's ICS environment. They have two vulnerabilities with the same base score of 8.8. Vulnerability A has a public exploit available and no vendor patch yet. Vulnerability B has no public exploit and a vendor patch released last week. The team can only patch one system this week. Which vulnerability should be prioritized?

   • ABoth equally, because the base scores are identical and base score is the only factor that matters.
   • BVulnerability B, because patching is always the best mitigation regardless of exploit availability.
   • CVulnerability B, because a patch is available and applying it eliminates the risk entirely.
   • DVulnerability A, because the public exploit increases the temporal score and the immediate risk of exploitation is higher.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A cybersecurity consultant is tasked with evaluating the vulnerability assessment capabilities of a small water utility. The utility uses a single vendor's scanner and wants to ensure that its assessment results can be shared with a regional threat intelligence sharing group. The group requires that all members submit findings in a standardized format. What should the consultant recommend?

   • AAdvise the utility to switch to a different scanner that uses a proprietary format preferred by the sharing group.
   • BSuggest that the utility use CVSS scores only, since they are the industry standard for sharing vulnerability information.
   • CRecommend that the utility manually transcribe the scanner's output into the sharing group's preferred spreadsheet template.
   • DEnsure the scanner can export OVAL-compliant definitions and results, so the findings can be shared in a standardized, machine-readable format.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A utility company uses two different vulnerability scanners: one from Vendor X for its Windows-based engineering workstations and one from Vendor Y for its Linux-based data historians. The security team wants to ensure both scanners produce consistent results for the same configuration checks. What is the most effective way to achieve this consistency?

   • AConfigure both scanners with identical custom scripts written by the security team.
   • BUse the same OVAL definitions in both scanners, since OVAL is a vendor-neutral standard for expressing checks.
   • CRun both scanners and manually reconcile the differences in a spreadsheet each time.
   • DUse CVSS scores to align the scanners' reporting formats.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why should an organization not rely solely on CVSS base scores when prioritizing vulnerabilities in an ICS/SCADA environment?

   • ABecause base scores are always too high
   • BBecause base scores are not standardized across vendors
   • CBecause base scores are only applicable to IT systems, not OT systems
   • DBecause base scores do not account for the criticality of the affected asset or the current threat landscape
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is reviewing a vulnerability report for a gas pipeline SCADA system. The CVSS vector string is: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The analyst needs to explain to the operations manager why this vulnerability is rated critical even though the affected device is behind a firewall. Which statement accurately describes the base score's meaning?

   • AThe base score is incorrect because a firewall-protected device should have a lower attack vector value.
   • BThe base score already accounts for the firewall because AV:N means the vulnerability is only exploitable through a network firewall.
   • CThe base score reflects the worst-case scenario assuming the firewall is misconfigured, so it is always the most accurate score.
   • DThe base score assumes the attacker can reach the device over the network without authentication, but the firewall is an environmental factor not reflected in the base score.
   Reveal Solution Discussion Select an answer first