Hide Vulnerability CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of assigning a severity rating to a vulnerability?

   • ATo help stakeholders prioritize remediation efforts based on the potential impact
   • BTo determine the exact financial cost of the vulnerability
   • CTo decide whether the vulnerability should be reported at all
   • DTo rank the vulnerability in a public leaderboard of security researchers
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A tester finds a vulnerability that allows an attacker to read the contents of a database, but only if they are already authenticated as a low-privileged user. The database contains non-sensitive operational data. How should the tester rate the severity of this finding?

   • AHigh, because it involves a database and data exfiltration.
   • BMedium, because it requires authentication and the data exposed is non-sensitive.
   • CCritical, because any unauthorized data access is a serious breach.
   • DLow, because the data is non-sensitive and the vulnerability is not exploitable.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A researcher discovers a vulnerability in a small, open-source project maintained by a single developer. The researcher has tried to contact the developer via email and the project's issue tracker but has received no response for several weeks. The vulnerability is serious and could be exploited. What is the most appropriate next step?

   • APublish the vulnerability details publicly to force the developer to respond.
   • BEscalate the issue by seeking other maintainers, looking for a security contact, or considering a limited public disclosure after a reasonable waiting period.
   • CAbandon the effort and move on to other projects, as the developer is clearly not interested.
   • DContinue to wait indefinitely for the developer to respond before taking any further action.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is the most appropriate channel for reporting a vulnerability discovered in a commercial software product?

   • AA personal blog post with full technical details
   • BThe vendor's official security contact or bug bounty program
   • CA public social media post tagging the vendor
   • DAn email to the vendor's general customer support address
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security researcher is part of a team that discovers a vulnerability in a widely used software library. The team is planning to disclose the vulnerability to the vendor. However, a team member wants to publish a blog post about the discovery to gain recognition. What is the most important consideration for the team to discuss?

   • AThe legal implications of publishing the vulnerability details.
   • BThe potential for the blog post to be picked up by the media and generate publicity for the team.
   • CThe best platform to use for the blog post to reach the widest audience.
   • DThe need to coordinate the blog post with the vendor's patch release to ensure users are protected.
   Reveal Solution Discussion Select an answer first