Augmenting Vulnerability Management with Threat Intelligence TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations team wants to reduce the time between vulnerability discovery and remediation by integrating threat intelligence into their automated workflows. They currently use a vulnerability scanner, a SIEM, and a ticketing system. Which integration would BEST enable automated, threat-informed response?

   • AConfigure the vulnerability scanner to automatically patch all vulnerabilities with a CVSS score above 8.0.
   • BSet up the SIEM to correlate vulnerability scan data with threat intelligence feeds and automatically create high-priority tickets for matches.
   • CHave the ticketing system automatically close any vulnerability ticket that has not been exploited within 30 days.
   • DUse the vulnerability scanner to export all findings to a spreadsheet for manual review by the security team.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After implementing threat-intelligence-informed prioritization in their vulnerability management program, a security manager wants to measure whether the integration is effective. Which metric would BEST indicate that the program is achieving its goal?

   • AThe total number of vulnerabilities identified in the environment.
   • BThe percentage of vulnerabilities remediated within 30 days of discovery.
   • CThe number of vulnerabilities that were actively exploited before remediation.
   • DThe percentage of exploited vulnerabilities that were identified and remediated before a breach occurred.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing a vulnerability in a database server that is only accessible from the internal network. The CVSS score is 7.5, and threat intelligence shows that a known threat actor group has been exploiting this vulnerability in other organizations, but only through internet-facing systems. How should the analyst contextualize this vulnerability?

   • ATreat it as a high priority because the threat actor group is known to exploit it.
   • BImmediately patch the database server because any known exploit activity makes it critical.
   • CIgnore the vulnerability because the CVSS score is below 9.0.
   • DConsider it a lower priority because the attack vector used by the threat actor is not applicable to the internal-only exposure.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a vulnerability that has a CVSS score of 7.0 and is present on a public-facing web server. Threat intelligence shows that the vulnerability is not currently being exploited, but a known threat actor group has been observed scanning for it. The analyst also notes that the vulnerability is in a legacy system that cannot be easily patched. What should the analyst do?

   • AIgnore the vulnerability because the CVSS score is only 7.0.
   • BImplement compensating controls, such as network segmentation or web application firewall rules, while planning a longer-term remediation.
   • CDeprioritize the vulnerability because it is not currently being exploited.
   • DImmediately shut down the public-facing web server to eliminate the risk.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses an on-premises vulnerability scanner that generates thousands of findings each month. The security team is overwhelmed and often misses critical vulnerabilities that are actively exploited. They want to integrate threat intelligence to automatically prioritize and route findings to the appropriate remediation teams. Which approach best achieves this goal?

   • AIncrease the frequency of vulnerability scans to reduce the number of findings per scan.
   • BIntegrate the vulnerability scanner with a threat intelligence platform (TIP) and orchestration tool to enrich findings and automatically create prioritized tickets.
   • CConfigure the vulnerability scanner to automatically apply CVSS scores and generate tickets for all critical findings.
   • DManually cross-reference each vulnerability with threat intelligence feeds and then create tickets.
   Reveal Solution Discussion Select an answer first