Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A vulnerability in a remote terminal unit (RTU) has a CVSS base score of 7.5. The vendor has released a patch, but it has not been widely tested in the ICS environment. There is no public exploit code. The security team is deciding whether to prioritize this vulnerability. What is the most appropriate next step?

   • AImmediately apply the patch without testing because the base score is high.
   • BUse the base score of 7.5 as the final score and prioritize it above all lower base scores without further analysis.
   • CIgnore the vulnerability because the patch is available and there is no exploit code.
   • DCalculate the temporal score using the available patch and lack of exploit code, which will likely lower the score, and then compare it with other vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is calculating the environmental score for a vulnerability affecting a safety instrumented system (SIS) controller. The base score is 8.0. The organization has determined that the confidentiality requirement is low (CR:L), the integrity requirement is high (IR:H), and the availability requirement is high (AR:H). The vulnerability is only exploitable from the local network (MAV:A). Which statement best describes the effect of these environmental metrics on the final score?

   • AThe environmental score will be higher than the base score because the integrity and availability requirements are high.
   • BThe high integrity and availability requirements will likely increase the environmental score, while the low confidentiality requirement and modified attack vector may partially offset this increase.
   • CThe environmental score will be lower than the base score because the modified attack vector is adjacent rather than network.
   • DThe environmental score will be the same as the base score because the requirements and modified metrics cancel each other out.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A water treatment facility uses a vulnerability scanner that reports a CVSS v3.1 base score of 9.8 for a remote code execution flaw in a human-machine interface (HMI) server. The HMI is isolated on a flat OT network with no internet connectivity, requires local authentication, and is scheduled for replacement in 60 days. The security team has limited patching windows and must prioritize this week's maintenance. What should the team do with this finding?

   • AUse the raw base score of 9.8 to justify immediate patching, since CVSS scores are the definitive measure of risk.
   • BRecalculate the environmental score using the CVSS vector with modified attack vector (local) and reduced confidentiality/integrity/availability requirements, then compare that adjusted score against other findings.
   • CIgnore the vulnerability entirely because the system is air-gapped and will be replaced soon.
   • DTreat it as the highest priority and schedule an emergency outage to patch immediately, regardless of the isolation.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In an ICS/SCADA environment, why is it beneficial to use OVAL results alongside CVSS scores when deciding which vulnerabilities to remediate first?

   • AOVAL confirms which vulnerabilities are actually present, while CVSS indicates their severity, allowing prioritization of confirmed high-severity issues on critical assets
   • BOVAL provides the CVSS score, so no separate calculation is needed
   • COVAL eliminates the need for CVSS because it directly measures risk
   • DCVSS can be used to patch vulnerabilities, and OVAL verifies the patch
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of an OVAL 'state' in a vulnerability assessment test?

   • ATo provide a human-readable description of the vulnerability
   • BTo define the expected values or conditions that indicate the vulnerability is present
   • CTo identify the system component to be checked
   • DTo store the CVSS score for the vulnerability
   Reveal Solution Discussion Select an answer first