Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A power generation facility has two critical vulnerabilities to remediate. Vulnerability A has a CVSS base score of 9.8, but the affected device is a non-critical monitoring sensor on a segmented network with no internet access. Vulnerability B has a CVSS base score of 7.2, but it affects the main control server that is accessible from the corporate network and has a public exploit available. The facility has a maintenance window that allows only one patch this week. Which vulnerability should be patched first?

   • ABoth vulnerabilities equally, because both have high base scores and the maintenance window should be used efficiently.
   • BVulnerability A, because the base score is higher and CVSS base scores are the primary factor for prioritization.
   • CVulnerability A, because the affected device is on a segmented network, which makes it more secure and thus a higher priority to patch.
   • DVulnerability B, because the public exploit and corporate network accessibility increase its effective risk, despite the lower base score.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security engineer is reviewing a vulnerability report for a distributed control system (DCS) server. The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The engineer knows that the DCS server is connected to the corporate network, but the organization has strict confidentiality requirements for its process data. The engineer wants to compute an environmental score that reflects the organization's priorities. Which environmental metric adjustment is most appropriate?

   • ASet the integrity requirement (IR) to high, since process data integrity is more important than confidentiality.
   • BSet the confidentiality requirement (CR) to high, and leave integrity and availability requirements at their default values.
   • CLeave all environmental metrics at their default values, since the base score already reflects the severity.
   • DSet the availability requirement (AR) to high, since the DCS server must always be available.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing company wants to automate the verification of security configurations across its diverse fleet of ICS devices, including Windows workstations, Linux servers, and network appliances. The compliance team needs a single, standardized format to define these checks so that any commercial or open-source tool can execute them. Which standard should the team adopt?

   • ACVSS, because it provides a standardized scoring system for vulnerabilities.
   • BOVAL, because it provides a standardized XML schema for representing system configuration checks that can be shared across tools.
   • CA proprietary script format from the primary vendor, because it is optimized for their devices.
   • DA custom XML schema developed in-house, because it can be tailored to the company's specific needs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An ICS security analyst is writing an OVAL definition to check if a specific service is running on a SCADA historian server. The analyst needs the check to pass only if the service is running AND its start mode is set to 'Automatic'. Which OVAL component should the analyst use to express this combined condition?

   • AA single state that contains both the running status and start mode as separate fields.
   • BA test that references an object (the service) and two states (one for running status, one for start mode).
   • CTwo separate OVAL definitions, one for each condition, and then manually correlate the results.
   • DAn OVAL variable that combines the two conditions into a single boolean expression.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An OT security analyst is creating an OVAL definition to detect a misconfiguration in a safety PLC that could allow unauthorized changes to its logic. The check must verify that the PLC's password-protection setting is enabled and that the firmware version is not in a known vulnerable list. The analyst has access to OVAL objects for the PLC's configuration file and firmware version. Which OVAL structure should the analyst use?

   • ACreate a definition that directly references the configuration file object and the firmware version object without using tests.
   • BCreate two separate tests: one for the password-protection setting and one for the firmware version, then combine them with a logical AND in the definition.
   • CCreate a single test for the firmware version and ignore the password-protection setting, since the firmware version is the more critical check.
   • DCreate a single test that checks both the password-protection setting and the firmware version in one object.
   Reveal Solution Discussion Select an answer first