Augmenting Vulnerability Management with Threat Intelligence TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team wants to automate vulnerability remediation but is concerned about the risk of automatically patching systems that could break business-critical applications. They have threat intelligence that identifies which vulnerabilities are actively exploited. Which automation strategy best balances the need for speed with the need for stability?

   • ADo not automate any patching; rely entirely on manual patching to avoid any risk of breakage.
   • BAutomatically patch actively exploited vulnerabilities only on non-critical systems, and require manual approval for critical systems.
   • CAutomatically patch all vulnerabilities that are actively exploited, regardless of the system's criticality.
   • DAutomatically patch all systems, but only after a two-week observation period to ensure the patch is stable.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A vulnerability management team is reviewing a vulnerability in a widely used software product. The CVSS score is 8.1, and the vendor has released a patch. Threat intelligence shows that exploit code has been published, but it requires authentication and local access to the system. The affected systems are only accessible by authorized administrators via a jump host. How should the team contextualize this vulnerability?

   • ATreat it as an emergency because exploit code is publicly available.
   • BIgnore the vulnerability because the CVSS score is below 9.0.
   • CPrioritize it as a high-risk vulnerability because the exploit code is public, but note that the authentication and local access requirements reduce the immediate threat.
   • DAssume the vulnerability is not exploitable because the vendor released a patch.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why might a vulnerability with a lower CVSS score be prioritized over one with a higher CVSS score?

   • ABecause CVSS scores are not reliable at all
   • BBecause threat intelligence shows the lower-scored vulnerability is being actively exploited
   • CBecause the lower-scored vulnerability has a lower attack complexity
   • DBecause the higher-scored vulnerability is easier to patch
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is prioritizing vulnerabilities for remediation. They have a vulnerability with a CVSS score of 9.5 that is not currently exploited, but threat intelligence indicates that a known advanced persistent threat (APT) group has targeted similar organizations in the same sector. Another vulnerability has a CVSS score of 7.0 and is being actively exploited by ransomware groups. The team has limited resources and must choose which to address first. Which decision is most aligned with threat-informed prioritization?

   • AAddress the CVSS 7.0 vulnerability first because it is actively exploited, even though the CVSS score is lower.
   • BAddress both vulnerabilities at the same time to avoid leaving any risk unmitigated.
   • CAddress the CVSS 9.5 vulnerability first because the APT group is a sophisticated threat.
   • DDelay both until more threat intelligence is available.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   At which stage of the vulnerability management lifecycle can threat intelligence be integrated to most directly improve prioritization decisions?

   • APrioritization
   • BIdentification
   • CRemediation
   • DAssessment
   Reveal Solution Discussion Select an answer first