Which organization maintains the National Vulnerability Database (NVD)?

Internet Corporation for Assigned Names and Numbers (ICANN)

Cybersecurity and Infrastructure Security Agency (CISA)

National Institute of Standards and Technology (NIST)

International Organization for Standardization (ISO)

A small business owner receives a notification from their internet service provider about a widespread malware campaign targeting routers. The owner wants to know if their specific router model is affected and what steps to take. Which source is most appropriate to get timely, actionable information?

Check the US-CERT (CISA) alerts page for a relevant advisory

Use Shodan to see if the router is exposed and assume it is safe if not

Wait for the router vendor to send an email update

Search the NVD for the router model and review all CVEs

How can NVD and Shodan be used together to assess exposure to a specific vulnerability?

Use Shodan to publish security advisories

Use NVD to scan the internet for vulnerable devices

Use Shodan to assign CVSS scores to vulnerabilities

Use NVD to find the CVE and affected versions, then use Shodan to search for devices running those versions

An IoT security analyst at a smart-building firm is investigating a vulnerability report that mentions a specific firmware version of a building-automation controller. The analyst needs to determine whether the reported CVE applies to the exact product and version deployed, and also needs the severity score to prioritize remediation. Which NVD feature should the analyst use first?

Query Shodan for the controller's default port to see if the CVE is listed in the device banner

Check the US-CERT alerts page for a bulletin that lists all CVEs for that firmware version

Use the NVD API to download the entire CVE feed and filter by the vendor name in a spreadsheet

Search the NVD by CVE ID and then review the CPE match criteria and CVSS vector for that entry

EC-CouncilIoT Security Essentials

Domain 5Objective 3

Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 5)

Part of the Cloud Security and Threat Intelligence domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 21–25

21foundation · easy
Which organization maintains the National Vulnerability Database (NVD)?
Select an answer first
22application · medium
A small business owner receives a notification from their internet service provider about a widespread malware campaign targeting routers. The owner wants to know if their specific router model is affected and what steps to take. Which source is most appropriate to get timely, actionable information?
Select an answer first
23foundation · easy
How can NVD and Shodan be used together to assess exposure to a specific vulnerability?
Select an answer first
24application · medium
An IoT security analyst at a smart-building firm is investigating a vulnerability report that mentions a specific firmware version of a building-automation controller. The analyst needs to determine whether the reported CVE applies to the exact product and version deployed, and also needs the severity score to prioritize remediation. Which NVD feature should the analyst use first?
Select an answer first
25foundation · easy
Which of the following is a publication type issued by US-CERT/CISA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 5)

Questions 21–25

Which organization maintains the National Vulnerability Database (NVD)?

How can NVD and Shodan be used together to assess exposure to a specific vulnerability?

Which of the following is a publication type issued by US-CERT/CISA?

Keep studying — Cloud Security and Threat Intelligence