Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security manager at a utility company is reviewing the organization's incident response plan. The manager wants to ensure the plan includes a process for receiving timely information about new vulnerabilities and threats. Which action best aligns with the role of CISA (formerly US-CERT) in this context?

   • ASet up a script to query the NVD API daily for new CVE entries and use that as the primary source of threat intelligence.
   • BRely on the organization's internal vulnerability scanner to provide all necessary threat intelligence.
   • CUse Shodan to monitor for new devices exposed on the internet and assume that any new device is a potential threat.
   • DSubscribe to CISA's alerts and advisories to receive timely notifications about new vulnerabilities and threats affecting critical infrastructure.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a valid way to search the NVD for a specific vulnerability?

   • AEnter the product's serial number in the NVD search box
   • BSubmit a request to the NVD help desk to receive a custom report
   • CUse the Shodan search engine to query the NVD database
   • DEnter the CVE ID, such as CVE-2024-1234, in the NVD search box
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A junior analyst is asked to find all known vulnerabilities for a specific model of a network camera. The analyst has the CPE identifier for the camera. Which action is most efficient to get a list of CVEs that affect this product?

   • AUse the NVD search feature with the CPE identifier as the keyword
   • BUse the CVE ID of a known vulnerability and check the CPE match criteria
   • CBrowse the US-CERT website for all advisories related to network cameras
   • DSearch Shodan for the camera model and look at the CVEs listed in the device banners
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is conducting a comprehensive risk assessment for a smart city project. The team has identified a specific model of traffic light controller that is internet-exposed. They need to determine the actual risk posed by this exposure. The team has access to the NVD, CISA advisories, and Shodan. Which approach provides the most accurate risk assessment?

   • AUse the CVSS score from the NVD as the sole indicator of risk, since it is the standardized measure of severity.
   • BUse CISA advisories as the primary source, since they provide the most up-to-date information about active threats.
   • CRely on Shodan's vulnerability data, since it provides real-time information about which devices are actively being exploited.
   • DCross-reference the CPE identifier from the NVD with Shodan results to confirm the exact firmware version, then check CISA advisories for known exploits and recommended mitigations.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is comparing two CVEs that affect the same IoT device. CVE-2024-0001 has a CVSS score of 9.8, and CVE-2024-0002 has a score of 4.3. The device is exposed to the internet. Which vulnerability should the analyst prioritize for patching?

   • ACVE-2024-0001, because it has a higher CVSS score and the device is exposed
   • BBoth equally, because both affect the same device
   • CNeither, because the device is exposed and will be replaced soon
   • DCVE-2024-0002, because lower scores are often easier to exploit
   Reveal Solution Discussion Select an answer first