Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A penetration tester is assessing the security of a client's internet-exposed IoT devices. The client has authorized the assessment but has asked the tester to minimize the risk of disrupting operations. The tester has identified a device running an outdated firmware with a known critical vulnerability. Which action is most appropriate?

   • ARecommend immediate replacement of the device without further analysis
   • BExploit the vulnerability to prove the risk, even if it may disrupt the device
   • CUse Shodan to confirm the exposure and then ignore the finding because the client authorized the assessment
   • DReport the finding and recommend patching, without attempting to exploit the vulnerability
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A small manufacturing company has just experienced a ransomware attack that affected several IoT-enabled production machines. The company's IT lead wants to understand the threat landscape and find guidance on how to prevent similar attacks. Which action best aligns with the role of CISA (formerly US-CERT) in this situation?

   • AReview the CPE entries in the NVD to determine which machines are vulnerable to ransomware.
   • BCheck CISA's website for alerts and advisories related to ransomware targeting industrial control systems and follow the recommended mitigations.
   • CSearch the NVD for the specific ransomware variant's CVE ID to find a patch for the affected machines.
   • DUse Shodan to search for the ransomware's command-and-control servers to identify the attackers.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary role of US-CERT (now part of CISA) in the context of vulnerability information?

   • ATo provide a search engine for internet-connected devices
   • BTo maintain the National Vulnerability Database (NVD)
   • CTo publish timely alerts, advisories, and bulletins about cybersecurity vulnerabilities and threats
   • DTo assign CVE identifiers to new vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can Shodan be used to identify devices running a vulnerable software version?

   • ABy checking the device's patch history
   • BBy scanning the device with a vulnerability scanner
   • CBy querying the NVD API directly from Shodan
   • DBy searching for the product name and version in the banner, such as 'Apache/2.4.49'
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is conducting a risk assessment for a smart city project. They have identified a CVE in the NVD with a CVSS score of 7.5, and Shodan shows that many devices are exposed on the internet. However, the devices are scheduled for replacement in three months. The team must decide whether to implement a temporary mitigation or accept the risk. Which decision is most justified?

   • AAccept the risk because the devices will be replaced soon
   • BIgnore the NVD score and rely on Shodan data only
   • CReplace all devices immediately to eliminate the vulnerability
   • DImplement a temporary mitigation, such as restricting access via firewall rules, because the exposure is high and the CVSS score is significant
   Reveal Solution Discussion Select an answer first