In CVSS, what does the Exploitability Score evaluate?

How easy it is to exploit the vulnerability

Which of the following best describes the difference between CVE and CWE?

CVE focuses on specific vulnerabilities, CWE describes underlying weakness

What does the CVSS vector string represent?

A textual summary of CVSS metrics

What is the purpose of the MITRE ATT&CK framework?

To document real-world attacker behaviors and techniques

What is the goal of the MITRE D3FEND framework?

Offer defensive strategies against known attack methods

What does a CVE entry represent?

A publicly disclosed security vulnerability

What does the CVSS Impact Score measure?

The potential consequences on confidentiality, integrity, and availability

studbud

iotsec-3

9 termsStudBud Administration12 plays

Imported from external platform

Flashcards9 cardsFPractice quizPHost liveL

Questions 9

Answers

1
In CVSS, what does the Exploitability Score evaluate?
The financial cost of the attack
The ease of writing a patch
The overall risk of the vulnerability
How easy it is to exploit the vulnerability
2
Which of the following best describes the difference between CVE and CWE?
CVE is about software bugs, CWE is about attacks
CVE focuses on specific vulnerabilities, CWE describes underlying weakness
CWE ranks vulnerabilities, CVE prevents them
CVE and CWE are the same
3
Which of the following CVSS metrics assesses whether user interaction is needed to exploit the vulnerability?
AC
UI
AV
PR
4
What does the CVSS vector string represent?
The original CVE discovery notes
The patch history of a vulnerability
The exact code snippet of the vulnerability
A textual summary of CVSS metrics
5
What is the purpose of the MITRE ATT&CK framework?
To score the security posture of organizations
To categorize programming flaws in source code
To document real-world attacker behaviors and techniques
To rate vulnerabilities using CVSS
6
What is the goal of the MITRE D3FEND framework?
Help with CVE database management
Track malware evolution
Provide offensive techniques for penetration testing
Offer defensive strategies against known attack methods
7
In the ATT&CK framework, what type of attack is ARP Cache Poisoning categorized as?
Exploit Public-Facing Application
Denial of Service
Privilege Escalation
Adversary-in-the-middle
8
What does a CVE entry represent?
A detailed hacking technique used in real attacks
A countermeasure against a cyberattack
A specific instance of a software weakness
A publicly disclosed security vulnerability
9
What does the CVSS Impact Score measure?
The number of users affected
The likelihood of the vulnerability being patched
How fast a vulnerability spreads
The potential consequences on confidentiality, integrity, and availability

iotsec-3 Flashcards | StudBud