Augmenting Vulnerability Management with Threat Intelligence TIE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which factor, when combined with CVSS scores, helps prioritize vulnerabilities based on real-world risk?

   • AThe age of the vulnerability
   • BThe number of security researchers who have analyzed the vulnerability
   • CThe vendor's reputation
   • DKnown exploit availability in public exploit databases
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A vulnerability management analyst is reviewing a critical vulnerability in a legacy application that is not exposed to the internet. The CVSS score is 9.8, but threat intelligence shows no known exploit code and no threat actor activity targeting this application. Meanwhile, a medium-severity vulnerability in an internet-facing web server has a public exploit and is being actively used in ransomware campaigns. How should the analyst contextualize these findings?

   • AConsider the web server vulnerability as a higher priority because it is internet-facing, has a public exploit, and is actively exploited, despite the lower CVSS score.
   • BIgnore the web server vulnerability because its CVSS score is lower than the legacy application's.
   • CTreat the legacy application as the highest risk because of its CVSS score, and deprioritize the web server vulnerability.
   • DAssign both vulnerabilities the same priority because they both have a CVSS score above 5.0.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team has integrated threat intelligence into their vulnerability management process. They want to track a KPI that demonstrates the value of this integration to management. Which KPI would be most meaningful?

   • AThe percentage of vulnerabilities remediated that were identified as actively exploited by threat intelligence.
   • BThe number of threat intelligence feeds subscribed to.
   • CThe total number of vulnerabilities discovered per month.
   • DThe average time to remediate all vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A vulnerability management team is establishing a formal lifecycle process. They have completed the identification and assessment stages and now need to decide how to prioritize remediation. They have access to threat intelligence that includes exploit kits, dark web discussions, and vendor advisories. Which action best incorporates threat intelligence into the prioritization stage?

   • AWait for the vendor to release a patch for every vulnerability before prioritizing any remediation.
   • BUse threat intelligence to identify which vulnerabilities are being actively exploited or have public exploit code, and combine that with asset criticality to set remediation order.
   • CPrioritize vulnerabilities based on the order they were discovered in the scan.
   • DRank vulnerabilities solely by their CVSS base score, since it is a standardized measure.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is overwhelmed by the number of vulnerabilities and needs to prioritize remediation. They have a vulnerability with a CVSS score of 9.0 that affects a critical internal database but is not being exploited and has no known exploit code. They also have a vulnerability with a CVSS score of 7.5 that affects an internet-facing web server and is listed in CISA's Known Exploited Vulnerabilities catalog. The team has limited resources and can only remediate one vulnerability this week. Which vulnerability should they remediate first?

   • ABoth vulnerabilities at the same time by splitting the team's resources.
   • BThe CVSS 9.0 vulnerability because it affects a critical asset.
   • CThe CVSS 7.5 vulnerability because it is actively exploited and internet-facing.
   • DNeither vulnerability until a full risk assessment is completed.
   Reveal Solution Discussion Select an answer first