Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In an NVD entry, what does a CVE identifier uniquely represent?

   • AA specific exploit code available in public repositories
   • BA specific version of a software product
   • CA specific security advisory published by a vendor
   • DA specific vulnerability in a specific product or product family
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is reviewing an NVD entry for a vulnerability in a smart thermostat. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The thermostat is not directly exposed to the internet but is on the same network as other devices. What is the most accurate interpretation of this vector?

   • AThe vulnerability can be exploited remotely without authentication, and the impact is high on confidentiality, integrity, and availability
   • BThe vulnerability can only be exploited if the attacker is on the same subnet
   • CThe vulnerability requires local access and authentication to exploit
   • DThe vulnerability has low impact on confidentiality but high impact on availability
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which Shodan search query would find devices with port 22 open?

   • Aproduct:22
   • Bcountry:22
   • Cport:22
   • Dhostname:22
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is documenting the affected products for a CVE in an NVD entry. The entry lists multiple CPE entries with different version ranges. The analyst needs to determine if a specific device with firmware version 1.2.3 is affected. What is the most reliable way to make this determination?

   • ASearch Shodan for the device and see if the CVE is listed in the banner
   • BCheck the US-CERT advisory for the CVE and see if the device model is mentioned
   • CUse the CVSS score to infer if the device is affected
   • DCompare the device's CPE identifier and version against the CPE match criteria in the NVD entry
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security operations team is investigating a potential breach of an IoT device. The team has identified the device's IP address and the firmware version. The team wants to determine if the device has any known vulnerabilities and if there is any threat intelligence about active exploitation. Which combination of sources provides the most comprehensive information?

   • AOnly use Shodan to check if the device is still exposed, since exposure is the most important factor in a breach.
   • BOnly check CISA advisories for threat intelligence, since they provide the most up-to-date information about active exploitation.
   • CQuery the NVD for the CPE identifier to find known CVEs, then check CISA advisories for any related threat intelligence, and use Shodan to see if the device is still exposed.
   • DOnly query the NVD for the CPE identifier to find known CVEs, since it is the most authoritative source.
   Reveal Solution Discussion Select an answer first