Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A water treatment facility uses a CVSS base score of 9.8 to prioritize patching a vulnerability in its PLC programming workstation. The workstation is on an isolated network segment with no internet access, requires physical presence to exploit, and is not connected to any corporate systems. The security manager insists on patching this vulnerability before a separate 7.5-scored vulnerability that is remotely exploitable from the corporate network and affects the HMI server. Which approach best addresses the prioritization flaw?

   • AIgnore both scores and patch based on the vendor's advisory order, since CVSS cannot be applied to ICS environments.
   • BRecalculate the scores using environmental metrics to reflect the isolated network and physical access requirement, then re-prioritize.
   • CUse the temporal score of the 9.8 vulnerability to lower it, since temporal metrics always reduce the base score.
   • DKeep the base scores as-is because CVSS is designed to be context-independent and the 9.8 score is universally more severe.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A vulnerability assessment of a remote terminal unit (RTU) management server identifies a flaw with the CVSS v3.1 vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N. The server is accessed only by two senior engineers via a jump host. The security manager asks whether this should be treated as a critical finding. What is the most accurate assessment of this vulnerability?

   • AIt is likely not critical in this environment because it requires local access, high privileges, user interaction, and high attack complexity, despite the high confidentiality impact.
   • BIt has a medium base score, but the environmental score should be raised because the RTU management server is a critical asset.
   • CIt is critical because the confidentiality impact is high, and any loss of confidentiality in an OT environment is unacceptable.
   • DIt is critical because the attack vector is local, meaning an attacker must already be inside the facility, which is the worst case.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a temporal metric in CVSS v3.x?

   • AAttack Vector (AV)
   • BUser Interaction (UI)
   • CExploit Code Maturity (E)
   • DConfidentiality Requirement (CR)
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is prioritizing vulnerabilities in a power utility's OT environment. Two findings have identical CVSS v3.1 base scores of 8.1. Finding 1 has a public exploit available and a vendor-provided patch that has been deployed to 90% of assets. Finding 2 has no known exploit and only a temporary workaround. The analyst must decide which to remediate first. What is the most appropriate action?

   • ATreat both findings equally because they have the same base score, so the order of remediation does not matter.
   • BRemediate Finding 1 first because the temporal score will be higher due to the available exploit, despite the patch being mostly deployed.
   • CRemediate Finding 2 first because the lack of a patch makes it more dangerous than a flaw with a mostly-deployed fix.
   • DDefer both findings until the next scheduled maintenance window because the base scores are identical and neither is critical.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A patch management engineer is reviewing a vulnerability report for a programmable logic controller (PLC) programming workstation. The report lists the following CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The workstation is on a segmented OT network, and the engineer needs to explain the exposure to the operations manager. Which statement accurately describes what this vector indicates?

   • AThe vulnerability requires local access to the workstation, but no authentication, and it has a medium impact on all security properties.
   • BThe vulnerability can be exploited remotely over the network without authentication or user interaction, and it has high impact on confidentiality, integrity, and availability within the affected component.
   • CThe vulnerability is exploitable only from the local network segment, requires elevated privileges, and has a moderate impact on availability only.
   • DThe vulnerability can only be exploited by an authenticated user who must physically interact with the workstation, and it has low impact on the system.
   Reveal Solution Discussion Select an answer first