An IoT security engineer is prioritizing patches for a fleet of smart meters. The engineer found a CVE entry in the NVD with a CVSS v3.1 base score of 9.8 and a vector string of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The engineer also noticed that the CPE entry for the affected firmware is listed as 'cpe:2.3:a:smart_meter_vendor:smart_meter_firmware:1.2.3:*:*:*:*:*:*:*'. Which interpretation of this data is most accurate for prioritization?

The vulnerability requires local access and user interaction, but has a low impact on all security attributes, and affects all versions of the smart meter firmware.

The vulnerability is remotely exploitable without authentication, has high impact on confidentiality, integrity, and availability, and affects only firmware version 1.2.3 of the specified product.

The vulnerability is only exploitable by an authenticated user on the local network, and the CPE entry indicates the vulnerability applies to the hardware model, not the firmware.

The CVSS score of 9.8 indicates a medium severity issue that requires physical access, and the CPE string is used to identify the vendor's website for patch downloads.

What is the main difference between a US-CERT Security Alert and a Security Advisory?

Alerts contain CVSS scores, while advisories do not

Alerts are only for government agencies, while advisories are for the public

Alerts are published daily, while advisories are published annually

Alerts are issued for imminent or actively exploited threats, while advisories provide information about vulnerabilities and mitigations

EC-CouncilIoT Security Essentials

Domain 5Objective 3

Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 10)

Part of the Cloud Security and Threat Intelligence domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 46–48

46application · medium
An IoT security engineer is prioritizing patches for a fleet of smart meters. The engineer found a CVE entry in the NVD with a CVSS v3.1 base score of 9.8 and a vector string of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The engineer also noticed that the CPE entry for the affected firmware is listed as 'cpe:2.3:a:smart_meter_vendor:smart_meter_firmware:1.2.3:*:*:*:*:*:*:*'. Which interpretation of this data is most accurate for prioritization?
Select an answer first
47foundation · easy
What is the main difference between a US-CERT Security Alert and a Security Advisory?
Select an answer first
48foundation · easy
A vulnerability in the NVD has a CVSS base score of 9.8. How is this score typically interpreted?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 10)

Questions 46–48

What is the main difference between a US-CERT Security Alert and a Security Advisory?

A vulnerability in the NVD has a CVSS base score of 9.8. How is this score typically interpreted?

Keep studying — Cloud Security and Threat Intelligence