Hide Vulnerability CT-STE Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A researcher finds a zero-day vulnerability in a popular VPN client. The vendor is responsive and estimates a patch will take 90 days. However, the researcher sees active exploitation of the vulnerability in the wild. What is the most appropriate action regarding public disclosure?

   • ACoordinate with the vendor to release a partial or limited public advisory sooner, warning users of active exploitation and providing temporary mitigations, while withholding the full exploit details.
   • BDo not disclose anything publicly and only inform the vendor, as that is the only responsible action.
   • CWait the full 90 days for the vendor's patch before any public disclosure, to adhere strictly to the agreed timeline.
   • DPublish the full details and exploit code immediately to force the vendor to act faster.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When reporting a vulnerability to a national Computer Security Incident Response Team (CSIRT), what is a key advantage?

   • AThe CSIRT will automatically fix the vulnerability for all affected users
   • BThe CSIRT provides a legal safe harbor from all liability for the tester
   • CThe CSIRT can coordinate with the vendor and other affected parties at a national level
   • DThe CSIRT guarantees that the vulnerability will be kept secret indefinitely
   Reveal Solution Discussion Select an answer first