Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What does the CVSS vector string in an NVD entry provide?

   • AThe date the vulnerability was publicly disclosed
   • BA recommended remediation plan for the vulnerability
   • CA detailed breakdown of the metrics used to compute the vulnerability's severity score
   • DA list of affected product versions in CPE format
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary advantage of using the NVD API over the web search interface?

   • AIt includes exploit code for each vulnerability
   • BIt allows automated retrieval of vulnerability data in a machine-readable format
   • CIt allows users to submit new vulnerabilities for inclusion in the NVD
   • DIt provides real-time alerts when new vulnerabilities are published
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the role of Common Platform Enumeration (CPE) entries in NVD records?

   • AThey list the patches or mitigations recommended by the vendor
   • BThey assign a severity score to each vulnerability
   • CThey identify the specific hardware, operating system, or application versions affected by a vulnerability
   • DThey provide a human-readable description of the vulnerability
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A penetration tester is conducting an external assessment for a client that manufactures industrial control systems. The tester wants to identify all internet-exposed programmable logic controllers (PLCs) in a specific country that are running a particular brand of software. Which Shodan search query best accomplishes this task?

   • Aport:502 country:Germany
   • Bcountry:DE product:PLC_Brand
   • Ccountry:DE port:80
   • Dproduct:PLC_Brand net:192.168.0.0/24
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations center (SOC) analyst is monitoring for new threats affecting the organization's IoT infrastructure. The analyst sees a new CISA advisory that references a CVE but does not include a CVSS score. The analyst also finds the same CVE in the NVD with a CVSS score of 7.5. What is the most appropriate action for the analyst?

   • AIgnore the CISA advisory because it lacks a CVSS score, and rely solely on the NVD data.
   • BUse the CISA advisory as the sole source of truth because it is more timely than the NVD.
   • CUse the CVSS score from the NVD to prioritize the vulnerability and follow the mitigation steps in the CISA advisory.
   • DSearch Shodan for the CVE ID to determine the CVSS score.
   Reveal Solution Discussion Select an answer first