Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team at a natural gas distribution company is integrating OVAL-based scanning with CVSS scoring. They have an OVAL definition that checks for a specific vulnerable version of a library on their Linux-based SCADA servers. The scan reports that 15 servers are vulnerable. The CVSS base score for the vulnerability is 9.1. However, the team discovers that the OVAL definition only checks the file version, not the running process, and some servers have the vulnerable file but are running a patched version from a different directory. What is the most significant limitation of this OVAL-based assessment?

   • AThe OVAL definition is not interoperable with the CVSS scoring system, so the results cannot be combined.
   • BThe CVSS score is too high and should be recalculated because the vulnerability is not exploitable on all servers.
   • CThe OVAL definition may produce false positives because it checks the file version rather than the actually loaded/running library version.
   • DThe scan results are useless because OVAL cannot be used for Linux systems.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does OVAL enable interoperability among different vulnerability assessment tools?

   • ABy requiring all tools to use the same scanning engine
   • BBy providing a central database of all vulnerabilities
   • CBy providing a standardized XML format that tools can use to share and interpret assessment definitions and results
   • DBy automatically patching vulnerabilities across different platforms
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of the Common Vulnerability Scoring System (CVSS)?

   • ATo identify the exact exploit code used in an attack
   • BTo provide a standardized method for rating the severity of security vulnerabilities
   • CTo automatically patch vulnerabilities in a system
   • DTo replace the need for vulnerability scanning tools
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which CVSS base metric describes the conditions required to exploit a vulnerability, such as whether the attacker needs special conditions or a race condition?

   • AUser Interaction (UI)
   • BPrivileges Required (PR)
   • CAttack Complexity (AC)
   • DAttack Vector (AV)
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In the CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C, which metric indicates the level of exploit code availability?

   • ARC:C
   • BRL:O
   • CAV:N
   • DE:P
   Reveal Solution Discussion Select an answer first