Vuln Priority Quiz: What Do You Patch First?

1. A zero-day vulnerability is disclosed but no patch exists yet. How do you prioritize mitigation?

Wait for the patch

Implement compensating controls (WAF, segmentation)

Ignore until vendor responds

Shut down affected systems immediately

2. When multiple vulnerabilities require patching, which approach best balances security and stability?

Patch everything immediately

Risk-rank, test, schedule maintenance windows

Only patch critical systems

Delay all patches until next quarter

3. What role does threat intelligence play in vulnerability prioritization?

It confirms CVSS scores only

It identifies active exploits and trending attacks

It eliminates the need for vulnerability scans

It determines patch budgets

4. A vulnerability has high CVSS but affects only outdated browsers. How should you assess priority?

Patch immediately due to CVSS

Check if systems actually use that browser

Ignore outdated software

Wait for vendor confirmation

5. Which organizational factor most impacts vulnerability prioritization strategy?

Industry compliance requirements (PCI, HIPAA)

Calendar month

Patch release schedule

Number of IT staff

6. A critical vulnerability is patched but conflicts with legacy software. What should you do?

Skip the patch to avoid breaking legacy systems

Test thoroughly and plan compatibility fixes

Immediately decommission legacy software

Apply patch only to some systems

7. What is the main advantage of using EPSS over CVSS alone for patch decisions?

EPSS is more accurate

EPSS reflects real-world exploitation likelihood

EPSS eliminates the need for CVSS

EPSS is faster to calculate

8. A vulnerability affects only development systems but has CVSS 9.1. Should you prioritize it equally with production flaws?

Yes; CVSS score determines priority

No; assess based on asset value and exposure

Only if exploits exist

Defer indefinitely

9. Your vulnerability scanner reports 200 flaws. What's the first step in prioritization?

Patch all vulnerabilities immediately

Filter by CVSS and asset criticality

Ignore low-severity items

Wait for executive approval

10. Which CVSS metric reflects whether an unauthenticated attacker can exploit a flaw?

Attack Complexity

Privileges Required

User Interaction

Attack Vector

11. What does CVSS stand for in vulnerability assessment?

Common Vulnerability Scoring System

Cyber Vulnerability Security Scale

Critical Vulnerability Service Standard

Comprehensive Vulnerability System Score

12. What does Privileges Required (PR) indicate in CVSS?

Admin rights needed to patch

Whether attacker needs prior system access

User authentication level for the fix

Patch deployment authorization

13. Two vulnerabilities: one CVSS 8.2 in a public-facing app, one CVSS 7.1 in an isolated lab system. Which patch first?

CVSS 8.2 (higher score)

CVSS 7.1 (lower risk)

The public-facing app (exposure matters)

Neither; scores determine priority only

14. Which vulnerability data source provides real-time threat intelligence for active exploits?

NVD only

CVSS scores alone

Threat feeds, IDS alerts, and exploit databases

Vendor release notes

15. A patch requires system reboot and affects 500 critical servers. What additional consideration applies?

Deploy immediately regardless

Plan maintenance windows and test first

Never patch critical systems

Wait for user approval

16. What does Attack Vector (AV) measure in CVSS scoring?

Whether the attacker needs network access

The complexity of exploitation

User interaction requirements

Impact on system confidentiality

17. A vulnerability exists in legacy software with no vendor support. How should you prioritize it?

Ignore it; vendor won't patch

Assess compensating controls and business risk

Immediately decommission the system

Wait for a zero-day announcement

18. Which factor should influence patch priority most when a vulnerability affects your organization?

The vendor's patch release date

Asset criticality and business impact

The number of CVEs released that month

Competitor patch timelines

19. What is the primary purpose of the Exploit Prediction Scoring System (EPSS)?

Calculate CVSS base scores

Estimate likelihood of exploitation in the wild

Measure patch deployment speed

Track vendor response times

20. A vulnerability with CVSS 9.8 has no known exploit code, while CVSS 6.5 is actively exploited in the wild. Which should you patch first?

CVSS 9.8 (highest score)

CVSS 6.5 (actively exploited)

Both simultaneously

Wait for more exploit code for 9.8