Augmenting Vulnerability Management with Threat Intelligence TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization uses a vulnerability management platform that supports API integrations. They want to automatically prioritize vulnerabilities based on threat intelligence and assign them to the appropriate remediation teams. Which automation strategy would be most effective?

   • AConfigure the platform to automatically apply a risk score based on CVSS and asset criticality only.
   • BExport all vulnerabilities to a spreadsheet and have the team manually prioritize them each week.
   • CUse the API to pull threat intelligence feeds and manually update the vulnerability records.
   • DSet up an orchestration workflow that enriches each vulnerability with threat intelligence and automatically creates and assigns tickets based on the enriched risk score.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team must prioritize vulnerabilities across two business units. Business unit A runs an internet-facing customer portal with a vulnerability that has a CVSS score of 6.5 and is listed in a public exploit database, but there is no evidence of active exploitation. Business unit B runs an internal HR system with a vulnerability that has a CVSS score of 9.0, but threat intelligence shows no known exploit and the system is not accessible from the internet. The team has limited patching capacity and must choose which to remediate first. Which decision best balances real-world risk and business impact?

   • AWait for more threat intelligence before making a decision.
   • BPatch both systems simultaneously, even if it means delaying other lower-priority work.
   • CPatch the internal HR system first because its CVSS score is significantly higher.
   • DPatch the internet-facing portal first because it has a public exploit and is exposed to the internet, even though the CVSS score is lower.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the vulnerability management lifecycle, what is the primary purpose of the prioritization stage?

   • ATo patch all vulnerabilities as quickly as possible
   • BTo identify all vulnerabilities present in the environment
   • CTo determine which vulnerabilities pose the greatest risk and should be addressed first
   • DTo assign a CVSS base score to each vulnerability
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst at a mid-sized company is reviewing a weekly vulnerability scan report. The report lists a critical-severity vulnerability in a legacy web server that has been present for six months. The analyst checks threat intelligence feeds and finds that the vulnerability is not being exploited in the wild, has no known exploit code, and is not mentioned in any current threat actor campaigns. However, the vulnerability is rated CVSS 9.8. According to threat-intelligence-informed prioritization, what should the analyst do with this vulnerability?

   • AIgnore the vulnerability entirely because it is not being exploited.
   • BPrioritize it for immediate remediation because the CVSS score is critical.
   • CImmediately block all traffic to the legacy web server to mitigate the risk.
   • DDeprioritize it and focus on lower-scored vulnerabilities that are actively exploited.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team wants to automate the response to vulnerabilities that are actively exploited in their industry. They have a SOAR platform and access to sector-specific threat intelligence. Which automation workflow would best leverage this intelligence?

   • ACreate a SOAR playbook that ingests sector-specific threat intelligence, correlates it with the vulnerability scanner's findings, and automatically triggers a patch or mitigation workflow for matching vulnerabilities.
   • BSend the threat intelligence feed to all employees and ask them to check their own systems for vulnerabilities.
   • CConfigure the vulnerability scanner to block all traffic to any system with a vulnerability mentioned in the threat feed.
   • DManually review the sector-specific threat intelligence and then manually patch any affected systems.
   Reveal Solution Discussion Select an answer first