Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the maximum base score that can be assigned to a vulnerability under CVSS v3.x?

   • A10.0
   • B8.9
   • C100.0
   • D9.9
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A control system engineer is explaining CVSS to a new technician. The technician asks why two vulnerabilities with the same 'High' base score might require different response times. The engineer should explain that the base score is:

   • AThe same for all industries, so response times should always be identical.
   • BOnly one component of the risk assessment; temporal and environmental metrics, along with asset criticality, must be considered for prioritization.
   • CThe definitive measure of risk and should be the only factor used to determine response time.
   • DAlways accurate because it is calculated by the vendor and cannot be changed.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A vulnerability in a PLC has a CVSS base score of 6.5. The temporal score is calculated as 5.9 due to the availability of an official patch and no public exploit. The environmental score is calculated as 7.1 because the PLC is critical to operations (high availability requirement) and is accessible from the corporate network. Which score should the security team use to prioritize this vulnerability against others?

   • AThe environmental score of 7.1, because it incorporates the organization's specific context and asset criticality, providing the most relevant risk assessment.
   • BThe temporal score of 5.9, because it reflects the current state of exploit availability and remediation.
   • CThe average of all three scores, because it provides a balanced view.
   • DThe base score of 6.5, because it is the standard score used for all comparisons.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following best describes the structure of an OVAL definition?

   • AA database record that stores CVSS scores
   • BAn XML document that includes metadata, a vulnerability or configuration issue description, and a set of tests to evaluate the system
   • CA binary executable that scans the system
   • DA plain-text file that lists all vulnerable software versions
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An engineer is creating an OVAL definition to check whether a specific Windows service is disabled on all engineering workstations. The engineer needs to ensure the check is reusable and can be updated easily if the service name changes. Which OVAL component should the engineer use to define the service name?

   • AA hardcoded service name in the object definition.
   • BA comment in the OVAL definition explaining the service name.
   • CA new OVAL test for each possible service name.
   • DAn OVAL variable, which allows the service name to be parameterized and referenced in the object definition.
   Reveal Solution Discussion Select an answer first