Prioritizing Vulnerabilities with CVSS and OVAL ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security engineer is calculating the CVSS v3.1 base score for a vulnerability in a building management system (BMS) controller. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The engineer needs to assign a qualitative severity rating. Which rating is correct for this base score?

   • ALow
   • BHigh
   • CMedium
   • DCritical
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A regional energy cooperative must submit vulnerability assessment reports to a federal regulator. The regulator requires that the reports be generated using a standardized, machine-readable format that can be validated and compared across all utilities. The cooperative currently uses a mix of custom scripts and vendor-specific reports. What should the cooperative adopt to meet the regulator's requirement?

   • AUse CVSS scores as the sole content of the reports, since they are standardized and machine-readable.
   • BAdopt OVAL as the standard for representing vulnerability checks and assessment results, ensuring all tools produce and consume the same format.
   • CContinue using custom scripts but add a summary PDF for the regulator, since the regulator only needs a human-readable summary.
   • DStandardize on a single vendor's proprietary report format and require all other tools to export to that format.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of the Open Vulnerability and Assessment Language (OVAL)?

   • ATo provide a standardized language for representing system configuration and vulnerability assessment checks
   • BTo automatically exploit vulnerabilities in a system
   • CTo replace CVSS in vulnerability scoring
   • DTo provide a database of known exploits
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following metric groups are part of the CVSS v3.x scoring system?

   • AConfidentiality, Integrity, and Availability
   • BBase, Attack, and Remediation
   • CBase, Temporal, and Environmental
   • DLocal, Adjacent, Network, and Physical
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security analyst is presenting a vulnerability management report to plant management. The report lists several vulnerabilities with CVSS scores. The plant manager asks, 'Why do we have a critical score of 9.8 for a vulnerability on a printer, but a high score of 7.5 for a vulnerability on our main control server? Shouldn't the server be more important?' What is the best response?

   • AThe CVSS score is wrong because the server is more important, so we should manually increase its score.
   • BThe printer vulnerability is more dangerous because it has a higher score, so we should patch it first.
   • CWe should ignore CVSS scores and only use the asset inventory to prioritize.
   • DThe CVSS base score measures the intrinsic severity of the vulnerability, not the importance of the asset; we need to consider the asset's criticality and environmental context to prioritize.
   Reveal Solution Discussion Select an answer first