Unpatched CVEs Vulnerability Assessment Quiz

1. Which vulnerability management phase occurs after identifying unpatched CVEs?

Scanning

Prioritization and remediation planning

Asset inventory

Report distribution

2. Which vulnerability management best practice helps prioritize unpatched CVEs most effectively?

Risk-based prioritization using CVSS and asset criticality

Patch all vulnerabilities in order of discovery

Ignore low-severity vulnerabilities

Prioritize based on vendor reputation

3. When assessing unpatched CVEs, what is the relationship between risk and compensating controls?

Compensating controls eliminate all CVE risk

Compensating controls can reduce risk when patches are unavailable

Compensating controls replace the need for patches

Compensating controls have no impact on CVE risk

4. True or False: A vulnerability with no available patch cannot be remediated.

True

False

5. The CVSS base score measures vulnerability severity in isolation; what does temporal score account for?

Time of day the vulnerability exists

Exploit availability and patch status

Number of days since discovery

System uptime duration

6. What does a vulnerability assessment report typically include about unpatched CVEs?

CVE ID, CVSS score, affected asset, and remediation steps

Only CVE ID numbers

Network topology diagrams

User account information

7. Which factor should influence the urgency of patching an unpatched CVE? (Select all that apply)

CVSS severity score

System criticality

Exploit availability

Vendor name

Submit

8. A vulnerability scanner reports CVE-2024-1234 on a legacy system. What should you do first?

Immediately patch the system

Verify CVE details and check patch availability

Isolate the system from the network

Document the finding and ignore

9. What is the CVSS vector component that measures how a vulnerability is exploited?

Impact

Attack Vector

Scope

Confidentiality

10. True or False: All high-CVSS vulnerabilities must be patched immediately regardless of business impact.

True

False

11. What does CVE stand for in vulnerability assessment?

Common Vulnerability Enumeration

Common Vulnerabilities and Exposures

Cyber Vulnerability Exploitation

Critical Vector Exposure

12. When conducting a vulnerability scan, what is the primary purpose of asset discovery?

Identify all network devices and services

Determine network bandwidth

Monitor user activity

Measure response times

13. What does EOL (End of Life) mean for software in vulnerability assessment?

Software is no longer receiving security patches

Software license has expired

Software is no longer installed

Software performance has declined

14. Which of the following should be checked when assessing unpatched systems? (Select all that apply)

Installed patch levels

Known CVE associations

Network uptime metrics

CVSS severity scores

Submit

15. What is the primary benefit of patch management in reducing CVE risk?

Eliminates all network threats

Closes known security gaps before exploitation

Prevents network connectivity issues

Reduces bandwidth consumption

16. True or False: A zero-day vulnerability always has a CVE assigned before exploitation occurs.

True

False

17. Which scanning tool is commonly used to detect unpatched vulnerabilities?

Nessus

Wireshark

Nmap

Netcat

18. A CVSS score of 9.0–10.0 indicates what severity level?

Low

Medium

High

Critical

19. What does CVSS measure in vulnerability assessment?

Patch deployment speed

Severity and impact of a vulnerability

Number of exploits available

Vendor response time

20. Which database is the primary source for official CVE information and scoring?

NVD (National Vulnerability Database)

CVSS Registry

Exploit Database

SecurityFocus Archive

Vuln Assessor Checking for Unpatched CVEs Quiz

1. Which vulnerability management phase occurs after identifying unpatched CVEs?

2.

What first name or nickname would you like us to use?

2. Which vulnerability management best practice helps prioritize unpatched CVEs most effectively?

3. When assessing unpatched CVEs, what is the relationship between risk and compensating controls?

4. True or False: A vulnerability with no available patch cannot be remediated.

5. The CVSS base score measures vulnerability severity in isolation; what does temporal score account for?

6. What does a vulnerability assessment report typically include about unpatched CVEs?

7. Which factor should influence the urgency of patching an unpatched CVE? (Select all that apply)

8. A vulnerability scanner reports CVE-2024-1234 on a legacy system. What should you do first?

9. What is the CVSS vector component that measures how a vulnerability is exploited?

10. True or False: All high-CVSS vulnerabilities must be patched immediately regardless of business impact.

11. What does CVE stand for in vulnerability assessment?

12. When conducting a vulnerability scan, what is the primary purpose of asset discovery?

13. What does EOL (End of Life) mean for software in vulnerability assessment?

14. Which of the following should be checked when assessing unpatched systems? (Select all that apply)

15. What is the primary benefit of patch management in reducing CVE risk?

16. True or False: A zero-day vulnerability always has a CVE assigned before exploitation occurs.

17. Which scanning tool is commonly used to detect unpatched vulnerabilities?

18. A CVSS score of 9.0–10.0 indicates what severity level?

19. What does CVSS measure in vulnerability assessment?

20. Which database is the primary source for official CVE information and scoring?