Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A multi-site chemical manufacturer uses different vulnerability scanners at each site. The corporate security team wants to aggregate the results into a single dashboard for executive reporting. Each scanner supports OVAL, but the sites have configured their scanners with different OVAL definition versions and custom definitions. What is the most important step to ensure consistent and comparable results across all sites?

   • AUse the CVSS scores from each scanner to compare results, since CVSS is standardized and independent of OVAL definitions.
   • BAggregate the results manually in a spreadsheet, noting the OVAL version used at each site.
   • CSelect the scanner with the most comprehensive OVAL support and require all sites to use that scanner.
   • DStandardize on a single OVAL definition version and a common set of definitions across all sites, and validate that each scanner can process them consistently.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A pharmaceutical plant's OT team receives an OVAL-based assessment report that identifies a vulnerable version of a historian database service on 15 of 200 assets. The CVSS v3.1 base score for the vulnerability is 9.1, but the affected assets are non-critical data collectors with no direct process control. The team must decide how to respond. What is the most appropriate action?

   • APatch all 15 assets in the next maintenance window, but do not treat this as an emergency because the assets are not directly involved in process control.
   • BIgnore the finding because the assets are non-critical and the vulnerability is only in a data collection service.
   • CTreat this as a critical incident and shut down the 15 assets immediately to prevent exploitation.
   • DPatch only the assets that are directly connected to the process control network, and leave the others unpatched.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A manufacturing company uses three different vulnerability scanners from different vendors across its ICS/SCADA environment. The security team wants to consolidate the results into a single report that can be shared with regulators and used for remediation tracking. The scanners produce output in different proprietary formats. What should the team implement to enable standardized, tool-agnostic vulnerability assessment and reporting?

   • AUse CVSS scores alone to compare the findings from each scanner, since CVSS is a standardized scoring system.
   • BUse OVAL definitions to represent the vulnerability checks in a standardized XML format that each scanner can interpret and report against.
   • CManually convert each scanner's output into a common spreadsheet format and reconcile the results by hand.
   • DSelect one scanner as the single source of truth and discontinue the other two scanners.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team is prioritizing vulnerabilities in a hybrid ICS/IT environment. They have a vulnerability with a CVSS base score of 9.0 that affects a critical ICS server. However, the server is air-gapped and requires physical access to exploit. They also have a vulnerability with a base score of 6.5 that affects an IT server on the corporate network with a public exploit available. The team has limited resources and can only remediate one this month. Which vulnerability should be prioritized?

   • ABoth equally, because both have significant risk factors.
   • BThe ICS server vulnerability, because the impact of a successful attack on ICS is always catastrophic.
   • CThe IT server vulnerability, because the public exploit and network accessibility make it a more immediate and likely threat, despite the lower base score.
   • DThe ICS server vulnerability, because the base score is higher and ICS systems are always a higher priority.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a limitation of using CVSS scores for vulnerability prioritization?

   • ACVSS scores are only available for commercial software
   • BCVSS scores are not accepted by industry standards
   • CCVSS scores do not reflect the likelihood that a vulnerability will be exploited in a specific environment
   • DCVSS scores are too complex to calculate manually
   Reveal Solution Discussion Select an answer first