Augmenting Vulnerability Management with Threat Intelligence TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security manager wants to justify the investment in threat intelligence to the board. The team has been using threat intelligence to prioritize vulnerabilities for six months. Which KPI would most convincingly demonstrate the value of threat intelligence in vulnerability management?

   • AThe reduction in the mean time to remediate (MTTR) for vulnerabilities that were identified as actively exploited.
   • BThe number of threat intelligence feeds subscribed to.
   • CThe total number of vulnerabilities patched in the last quarter.
   • DThe number of security analysts on the team.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is a common benefit of orchestrating vulnerability management with threat intelligence?

   • AGuaranteeing that all vulnerabilities are patched within 24 hours
   • BEliminating all false positives from vulnerability scans
   • CFaster response to newly discovered exploited vulnerabilities
   • DRemoving the need for security analysts
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During a vulnerability assessment, a security analyst finds a vulnerability in a web application that is not currently being exploited. However, threat intelligence reports indicate that a known advanced persistent threat (APT) group has recently developed a weaponized exploit for this vulnerability and is targeting organizations in the same industry. What should the analyst do?

   • AIgnore the vulnerability because it is not currently being exploited.
   • BEscalate the vulnerability to a high priority and expedite remediation.
   • CTreat the vulnerability as a low priority because there is no active exploitation yet.
   • DWait for the vulnerability to be added to the CISA KEV catalog before taking action.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A vulnerability management team is deciding which vulnerabilities to remediate in the next patch cycle. They have two vulnerabilities: one with a CVSS score of 9.8 that is not being exploited and affects an internal development server, and another with a CVSS score of 7.2 that is being actively exploited in the wild and affects a public-facing web server. Which vulnerability should be remediated first?

   • AThe CVSS 7.2 vulnerability because it is actively exploited and affects a public-facing system.
   • BNeither vulnerability until a full risk assessment is completed.
   • CThe CVSS 9.8 vulnerability because it has a higher severity score.
   • DBoth vulnerabilities at the same time because they are both above the high severity threshold.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team wants to automate vulnerability prioritization using threat intelligence, but they are concerned about the accuracy of the threat intelligence feeds and the potential for false positives. They also need to ensure that critical vulnerabilities are not missed. Which approach best balances automation with human oversight?

   • AFully automate the prioritization and remediation process without human review.
   • BRely solely on manual prioritization to avoid any risk of automation errors.
   • CUse automation only for low-severity vulnerabilities and manual review for high-severity ones.
   • DUse automation to enrich and prioritize vulnerabilities, but require human approval for any remediation actions.
   Reveal Solution Discussion Select an answer first