Vulnerability Databases (National Vulnerability Database, US-CERT, Shodan) ISE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security architect is designing a vulnerability management program for a large IoT deployment. The architect has access to NVD, US-CERT, and Shodan. The goal is to identify and prioritize vulnerabilities based on real-world exposure. Which process is most effective?

   • AUse Shodan to find exposed devices and patch them all immediately, regardless of CVSS score
   • BUse NVD to get CVSS scores, Shodan to identify exposed devices, and US-CERT for actionable alerts, then prioritize based on the combination
   • CUse US-CERT alerts only, as they provide the most actionable information
   • DUse only NVD CVSS scores to prioritize, as they are the most authoritative
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network administrator for a hospital receives an email from a security vendor about a new vulnerability in a medical device. The administrator wants to confirm the severity and get actionable mitigation steps from a government source. Which resource should the administrator consult first?

   • AThe vendor's own security bulletin
   • BUS-CERT (CISA) alerts and advisories page
   • CThe NVD CVE entry only
   • DShodan search results for the device model
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is investigating a suspected compromise of a building automation controller. The analyst found the controller's IP address in a Shodan search and wants to determine whether the specific firmware version running on the device has any known vulnerabilities. The analyst also needs to check whether the US-CERT (CISA) has published any actionable guidance for this device family. Which sequence of actions best fulfills the analyst's requirements?

   • AReview CISA bulletins for the controller's IP address, then query Shodan for the CVE ID of the firmware.
   • BQuery the NVD API using the CPE identifier for the controller's firmware, then review CISA's published advisories for the same product family.
   • CUse the NVD's CVE ID search with the device's serial number, then check Shodan for the same serial number.
   • DSearch Shodan for the controller's open ports, then use the NVD keyword search with the device's MAC address.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team is prioritizing vulnerabilities for a fleet of IoT devices. They have identified a CVE in the NVD with a CVSS score of 9.8, but Shodan shows that only a few devices are exposed to the internet. The team must decide whether to patch immediately or defer. Which approach best balances risk and operational impact?

   • APatch immediately because the CVSS score is critical, regardless of exposure
   • BDefer patching because the exposure is low, and focus on other vulnerabilities
   • CPrioritize patching the exposed devices first, then plan to patch the rest during the next maintenance window
   • DUse Shodan to block all internet access to the devices and then ignore the vulnerability
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary function of Shodan?

   • AIt is a patch management system for IoT devices
   • BIt is a vulnerability database maintained by the U.S. government
   • CIt is a tool for scanning local networks for open ports
   • DIt is a search engine that indexes internet-connected devices and services
   Reveal Solution Discussion Select an answer first