Understand Vulnerability Context and Remediation Frameworks GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security engineer receives a Dependabot alert for a vulnerability in a JavaScript library used by a customer-facing web application. The CVE has a CVSS score of 9.8, but the vulnerable function is only called in an administrative endpoint that requires authentication. The application is behind a Web Application Firewall (WAF) that blocks most external traffic. The team has limited remediation resources this sprint. What should the engineer prioritize?

   • AIgnore the alert because the WAF and authentication make the vulnerability unexploitable.
   • BImmediately update the library to the patched version in the current sprint.
   • CAssess the exploitability and asset criticality, then schedule the update based on the combined risk.
   • DDefer the update until the next scheduled dependency maintenance window.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common remediation action for a vulnerable dependency?

   • AChanging the license of the dependency
   • BUpdating the dependency to a patched version
   • CDeleting the dependency from the repository
   • DIgnoring the alert if the dependency is not directly used
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is triaging a new GitHub Security Advisory. The advisory has a CVSS score of 7.5, but the affected component is not used in any of the organization's repositories. What should the team do?

   • AWait for Dependabot to alert on the component before acting.
   • BMark the advisory as not applicable and document the reason.
   • CIgnore the advisory because the component is not used.
   • DUpdate the component anyway to be safe.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Dependabot alert is raised for a vulnerability in a library that is only used in a development tool, not in production. The vulnerability has a CVSS score of 9.0, but the tool is only used by developers on their local machines. The team is considering dismissing the alert. What should they do?

   • ADismiss the alert because the tool is not in production.
   • BUpdate the library immediately because the CVSS score is high.
   • CAssess the risk of the development tool being exploited and whether it can access production data.
   • DIgnore the alert because Dependabot alerts are only for production dependencies.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a CVE identifier?

   • ATo provide a unique, standardized identifier for a publicly known security vulnerability
   • BTo categorize the root cause of a vulnerability based on a taxonomy of software weaknesses
   • CTo provide a detailed technical description of how to exploit a vulnerability
   • DTo assign a severity score to a vulnerability based on the CVSS framework
   Reveal Solution Discussion Select an answer first