Classify and Track Security Errors CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is comparing two vulnerabilities. Vulnerability A has a CVSS v3.1 base score of 9.0. Vulnerability B has a base score of 7.0. However, the analyst notes that a public exploit for Vulnerability B was released yesterday, while no exploit exists for Vulnerability A. How should the analyst adjust the prioritization?

   • APrioritize Vulnerability B because the existence of a public exploit increases its temporal score and likelihood of exploitation.
   • BPrioritize Vulnerability A because the base score is higher.
   • CTreat both vulnerabilities as equal priority because the base scores are the primary factor.
   • DPrioritize Vulnerability A because it is more likely to be targeted by advanced persistent threats (APTs).
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which two components are typically combined to calculate a risk score for a security vulnerability?

   • ALikelihood and impact
   • BConfidentiality and integrity
   • CCost and time
   • DAttack vector and complexity
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During a security review, a tester identifies a flaw in the login module that allows an attacker to bypass authentication. In CSSLP terminology, which term best describes this specific instance of a flaw that can be exploited?

   • AAn error
   • BA failure
   • CA defect
   • DA vulnerability
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is looking for a way to track vulnerabilities that are found in third-party libraries. They want to automate the process of identifying known vulnerabilities and creating tracking tickets. Which type of tool is most suitable for this task?

   • AA dynamic application security testing (DAST) tool.
   • BA static application security testing (SAST) tool.
   • CA software composition analysis (SCA) tool.
   • DA web application firewall (WAF).
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is reviewing a bug report. The report states that a user can cause the application to crash by sending a specially crafted request. The analyst determines that this crash can be used to execute arbitrary code. In this case, how should the issue be classified?

   • AAs a risk, because it has a likelihood and impact.
   • BAs a vulnerability, because the flaw can be exploited to violate a security policy (execute arbitrary code).
   • CAs an error, because it was caused by a mistake in the code.
   • DAs a defect, because it is a flaw in the code that causes a crash.
   Reveal Solution Discussion Select an answer first